Is webserver access mandatory to generate the token?

Venki24222

Hi Bugsounet,

Thanks for your great work.
I have a question regarding the Authorized redirect URIs- https://googleassistant.bugsounet.fr

Is access to your webserver mandatory to generate the token…?
Since this will allow broad access to our Google account, is there an alternative way?

Thanks!

bugsounet

Hi,

Authorized redirect URI is only used for read the code sended in argument from Google.
Why ?
Just because google not offer his page for copy/past the code since 6/7 month now
So it’s really complex to copy/past the code

That’s why I create a code reader

It verify scope source
it read code

sample
will display my very secret code in the url tagged like google make it with “code=”

Venki24222

Sounds good…thanks for the details!

bugsounet

yes it’s better for humain reading
After you can make your own.

create an https server (https is needed !)
make a script for reading “code=” value
redirect the uri to your webserver

bugsounet

Note: I will try to create Tokens directly with Gateway app without the “googleassistant” website soon

Venki24222

Sure…that will be great…! For now…I’m using your webserver for the code…

Destiny76

@bugsounet said in Is webserver access mandatory to generate the token?:

yes it’s better for humain reading
After you can make your own.

create an https server (https is needed !)

make a script for reading “code=” value

redirect the uri to your webserver

I followed the wiki for installing GA4. I’m just a rookie, it works, but I feel uncomfortable to give the URI of your server access to my account. Is there a part in the wiki that explains how the granted access to my google account is safe and secure?

bugsounet

the main question is for me:
Is google is really sure ?
why so many data are inside your account

After that a says some post upper:
Google redirect for to the URI for humain reading (with an HTTPS server)
It send for exemple: [https://googleassistant.bugsounet.fr/?code=my very secret code&scope=https://www.googleapis.com/auth/assistant-sdk-prototype]
My server read the link and search the part named code= and display the code found.

HTML Code is there:

<html>
  <head>
    <meta charset="UTF-8">
    <link rel="stylesheet" href="config.css" />
    <title>@bugsounet Consent OAuth screen ~ Code Reader</title>
    <script type="text/javascript">
      function getParameterByName(name) {
          url = window.location.href;

          name = name.replace(/[[]]/g, "\\$&");
          var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)");
          var results = regex.exec(url);
          if (!results) return null;
          if (!results[2]) return '';
          return decodeURIComponent(results[2].replace(/\+/g, " "));
      }

      document.addEventListener("DOMContentLoaded", function(event) {
        var code = getParameterByName('code');
        var scope = getParameterByName('scope');
        var scopeURLs = [
          "https://www.googleapis.com/auth/assistant-sdk-prototype",
          "https://www.googleapis.com/auth/youtube",
          "https://www.googleapis.com/auth/photoslibrary https://www.googleapis.com/auth/photoslibrary.sharing",
          "https://www.googleapis.com/auth/photoslibrary.sharing https://www.googleapis.com/auth/photoslibrary"
        ]
        var request= document.getElementById('request')
        if (code && scopeURLs.indexOf(scope) > -1) {
          request.style.display = "none";
          document.getElementById('code').innerHTML= "Your code:<br>" + code;
        }
      });
    </script>
  </head>
  <body>
    <div class="text">
      <h1><img class="google_icon" src="google.gif" >Consent OAuth screen</h1>
      <div>
        <h2><img class="logo" src="logo.png" ></h2>
      </div>
      <div class="backgroundform" id= "request">
        <div id= "uri"></div>
        <div>
          <p>NO CODE FOUND!<br>
        </div>
        <div>
          <p><br>Oupps, an error was happen.<br>We can't determinate your code.</p>
        </div>
        <div>
          <p>You can get support in <a class="link" href="https://forum.bugsounet.fr">4th Party modules</a></p>
        </div>
      </div>
      <div class="returncode" id="code"></div>
    </div>
    <footer class="footer">
      <p>Designed by @2hdlockness ~ ©bugsounet.fr 2022 ~</p>
    </footer>
  </body>
</html>

After, if you want really the source code, I can create a repo with it

Or… just copy the index file from the source with this command:

wget https://googleassistant.bugsounet.fr/index.html

and edit/view the code of index.html

Unsolved Is webserver access mandatory to generate the token?