Oauth2 restrict to emails with specific domain name using hd not working

Question

My app was restricting logins by Oauth2 to specific domain like abc.com by specifying abc.com in the hd parameter in my request .Restrict Login Email with Google OAuth2.0 to Specific Domain Name but since these past few days its allowing anyone with a Google account login.I am sure i didn't change the code and even verified the result uri has my domain name specified in its hd parameter following this link instruction https://developers.google.com/identity/protocols/OpenIDConnect#hd-param .so cany any one tell me what i am doing wrong? here is my code

     `redirect( uri : "https://accounts.google.com/o/oauth2/auth?" +
            "redirect_uri=${redirectUri}&" +
            "response_type=code&" +
            "client_id="${my_client_id}"& +
            "scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email" +
            "+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&" +
            "approval_prompt=auto&" +
            "hd=apposit.com")`

I had the same situation, since a few weeks back the HD-parameter no longer restrict access to the specified domain. There was no change to the code, it just doesnt restrict access to the HD-parameter anymore... anyone know whats up? — sboss, Jan 18 '16 at 14:12

robel · Accepted Answer · 2016-02-15T12:10:12.393

10

I dont know why this is happening,but you can add a second security mechanism besides hd by checking if the user email contains abc.com using java's contains() method or endsWith() which is more reliable before u allow the user to go any further in Your app.

But still this is a quick fix and others with a solution should answer this question

edited Feb 15 '16 at 12:10

answered Dec 16 '15 at 18:06

robel

305
3
14

2

If I were you I'd be more carefull, cause it's quit easy to ommit this mechanism, by simply making account like **abc.comHACKER@gmail.com** or **hacker@abc.com.hacker.com**. – Michal_Szulc Jan 26 '16 at 09:52
3

I absolutely agree, but as i stated above its just a quick fix and the real solution should be finding a way to make hd working. – robel Jan 26 '16 at 11:39
1

Or you could use **endsWith()** method. – James Jan 31 '16 at 18:28
you could use a regex – José Dec 03 '18 at 20:03

Oauth2 restrict to emails with specific domain name using hd not working

1 Answers1

Linked