Page Summary
-
Cross-Account Protection helps improve the security of user accounts in your app that use Google Sign-in by sending security event notifications.
-
These notifications are delivered as cryptographically signed security event tokens to an endpoint you set up.
-
To use Cross-Account Protection, you need to set up a Google Cloud project, create an event receiver endpoint, and register your endpoint with Google.
-
Your receiver endpoint must validate and decode the security event tokens it receives before handling the events described within the tokens.
-
Cross-Account Protection supports various event types, and you should respond to them by taking appropriate security actions on the affected user's account within your app.
If your app lets users sign in to their accounts using Google, you can improve the security of these shared users' accounts by listening and responding to the security event notifications provided by the Cross-Account Protection service.
These notifications alert you of major changes to the Google Accounts of your users, which can often also have security implications for their accounts with your app. For instance, if a user's Google Account were hijacked, it could potentially lead to compromise of the user's account with your app through email account recovery or the use of single sign-on.
To help you mitigate the risk potential of such events, Google sends your service objects called security event tokens. These tokens expose very little information—just the type of security event and when it occurred, and the identifier of the affected user—but you can use them to take appropriate action in response. For example, if a user's Google Account were compromised, you could temporarily disable Sign In With Google for that user and prevent account recovery emails from being sent to the user's Gmail address.
Cross-Account Protection is based on the RISC standard, developed at the OpenID Foundation.
Overview
To use Cross-Account Protection with your app or service, you must complete the following tasks:
Set up your project in the API Console.
Create an event receiver endpoint, to which Google will send security event tokens. This endpoint is responsible for validating the tokens it receives and then responding to security events in whatever way you choose.
Register your endpoint with Google to start receiving security event tokens.
Prerequisite
You only receive security event tokens for Google users who have granted your
service permission to access their profile information or email addresses. You
get this permission by requesting the profile or email scopes. The newer
Sign In With Google or the legacy
Google Sign-in SDKs request these scopes by default, but
if you don't use the default settings, or if you access Google's OpenID
Connect endpoint directly, ensure
you are requesting at least one of these scopes.