How to pass in nonce?

Context:
You can not pass a rawNonce to signInWithGoogle.

When using signInWithGoogle on Android, the returned idToken does not return a nonce. This makes sense because a rawNonce is not passed in.

The same exact code when run on iOS, returns a hashed nonce in the idToken. This does not make sense since we can not pass in a nonce. Where is the nonce coming from?

In the case of Google Sign-In for iOS and macOS, nonce values are being generated by AppAuth and included with the auth request. During ID token validation, the nonce value of the ID token is then verified using the originally generated value.

@petea

@petea Oh interesting.
Now if I want to send this JWT with the hashed nonce, how can I get the original nonce used so that i can verify this myself on the backend?

How can I get the originally generated value?

I also see that the comment says

@discussion If this value is not explicitly set, this library will automatically add nonce and perform appropriate validation of the nonce in the ID Token.

Is there no way to explicitly set this value?

How can I get the originally generated value?

The nonce generated by AppAuth isn't available via the Google Sign-In API surface. Currently, the recommended approach to server-side validation of the ID token doesn't include validation of the nonce.

Is there no way to explicitly set this value?

AppAuth allows you to provide a specific nonce, if desired. However, Google Sign-In does not expose this capability in its API surface.

@petea

@petea
Oh I see, thanks for the clarification!

The lack of getting the raw nonce or specifying the raw nonce is blocking a few different users.

Would a PR to fix this be welcome in the future?

We need nonce support, too.
Apple and LINE supports this, so please consider.
We want to prevent Replay Attack.

@DanMossa

@DanMossa, PRs are always welcome. Can you provide more detail on the specific use cases that are blocked here? Are they all related to server-side verification of the nonce?

@toshi0383 is the existing automatic client-side nonce generation / validation not adequate for your needs?

@petea

automatic client-side nonce generation

@petea We generate nonce in our server-side, so we need manual way to do this.
I have a brand new branch for this, so will tackle in a PR in a few minutes!

Done!
#244

Hi all! Many apologies for the delay. Thanks for your patience.

Would you be able to share more information about your use-case? It seems to deviate from the typical use case where the nonce is generated by the client.

In general, it seems fine for GSI to provide an API to ingest a nonce to pass along to OIDAuthorizationRequest in AppAuth.

The nonce generated by AppAuth isn't available via the Google Sign-In API surface. Currently, the recommended approach to server-side validation of the ID token doesn't include validation of the nonce.

This is not true. The OIDC spec which Google follows explicitly states:

nonce
String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case sensitive string.

Please allow for people to be able to extract the nonce you send to Google.

@petea

@petea @toshi0383 can u help me setting up nonce in the google sign in package? Its an urgent usecase

@SunilKividor

@SunilKividor Hire someone and leave.
I have nothing to do with ur use case.
Stop mentioning us for nothing.

@toshi0383

@toshi0383 Thankyou for the response. We have moved to google credential management for setting up authentication with nonce. I appreciate your time.

Any news on that? The only way to set the nonce is to use AppAuth?

FYI my fork is an option too. #244
We're using this in production without any issues.

I have opened a PR to support this: #402

been a few months, any movement on this PR?

Done here: #402

I want to call out here that 9.0.0 is released containing the fix for this issue. Thanks everyone for your involvement!

Additional note: If you're using Google Sign-In 8.1.0-vwg-eap-1.0.x to fix this issue, you should know that we are getting rid of these pre-releases soon. Please use official release Google Sign-In 9.0.0 instead.

Hey everyone!

This is a final reminder that these pre-releases will be removed very soon from GitHub and CocoaPods. If you haven't already, please migrate to the official 9.0.0 release, which is our stable, long-term solution.

Thanks!

Navigation Menu

Repository navigation

How to pass in nonce? #135

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

How to pass in nonce? #135

Description

Activity

petea commented on Jun 13, 2022

DanMossa commented on Jun 13, 2022

petea commented on Jun 16, 2022

DanMossa commented on Jun 16, 2022

toshi0383 commented on Oct 25, 2022

petea commented on Oct 27, 2022

toshi0383 commented on Oct 27, 2022

toshi0383 commented on Oct 27, 2022

mdmathias commented on Jun 1, 2023

hf commented on Jul 20, 2023

SunilKividor commented on Apr 18, 2024

toshi0383 commented on Apr 24, 2024

SunilKividor commented on Apr 24, 2024

Massimiliano-solutiontech commented on Apr 25, 2024

toshi0383 commented on Apr 26, 2024

vonovak commented on Apr 28, 2024

GNUGradyn commented on Jul 9, 2024

riderx commented on Oct 4, 2024

brnnmrls commented on Jul 7, 2025

brnnmrls commented on Jul 10, 2025

brnnmrls commented on Sep 4, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions