title: How to retrieve and pass OpenID Connect ID Tokens from Chrome Extensions
body: <p>I’m building a Chrome extension that:</p>
  
  <ol>
  <li>Fetches data from a Google API (e.g. Drive) </li>
  <li>From the client, POSTs a different set of data to an API endpoint I control, over HTTPS</li>
  </ol>
  
  <p>In the client, using the chrome.identity API, I’m able to successfully retrieve a short-lived access token (using the implicit flow) that I can use to fetch data from Google APIs. When the token expires, I’m able to silently fetch another in the background. This portion works fine.</p>
  
  <p>Separately, for use case #2 above, I’d like to ensure only the target Google user can successfully POST data. For this purpose, I was considering utilizing the <a href="https://developers.google.com/identity/sign-in/web/sign-in" rel="nofollow noreferrer">Google Sign-In JavaScript library</a>, retrieving an ID token on successful auth and passing that ID token to my API for server-side validation, <a href="https://developers.google.com/identity/sign-in/web/backend-auth" rel="nofollow noreferrer">as noted here</a>.</p>
  
  <p>The Google Sign-In JavaScript library <a href="https://github.com/GoogleWebComponents/google-signin/issues/102" rel="nofollow noreferrer">doesn’t appear to work in Chrome extensions</a>. I was seeing the same error as the author of that issue (“<em>Uncaught gapi.auth2.ExternallyVisibleError: Invalid cookiePolicy</em>”) when trying to implement a Sign-In button within the extension.</p>
  
  <p>I would like to avoid managing any portion of the OAuth / OpenID Connect flow in a custom way. However, using the <a href="https://developer.chrome.com/apps/identity#method-launchWebAuthFlow" rel="nofollow noreferrer">chrome.identity.launchWebAuthFlow method</a>, I <em>am</em> able to retrieve an ID token, by directing the user to the Google OAuth endpoint using response_type=id_token, adding the correct scopes (“openid” and “email”, for instance) and <a href="http://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken" rel="nofollow noreferrer">passing a nonce</a>, like this:</p>
  
  <pre><code>https://accounts.google.com/o/oauth2/v2/auth?
  client_id=[client_id]&amp;
  response_type=id_token&amp;
  scope=scope=openid%20email&amp;
  redirect_uri=https://&lt;app-id&gt;.chromiumapp.org/redirect&amp;
  state=[state_token]&amp;
  nonce=[nonce]
  </code></pre>
  
  <p><strong>I have three questions</strong>:</p>
  
  <ul>
  <li>Is there a way to retrieve an ID token from Google using a client
  library that is known to work on Chrome extensions, so I don’t have
  to retrieve an ID token using a custom implementation?</li>
  <li>In general, is using the implicit flow to retrieve short-lived ID
  tokens from the client, passing that token to a server, and
  validating the token from the server using Google OAuth libraries an
  acceptable and secure way to manage this?</li>
  <li>If this is not ideal, is there a recommended way to validate the user
  from the API (use case #2) given some of the Chrome extension
  limitations I’m dealing with? E.g. by using the <a href="http://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth" rel="nofollow noreferrer">hybrid flow</a>, or
  another mechanism?</li>
  </ul>