Google Login

In addition to traditional email and password credentials, GO Shortener supports Single Sign-On (SSO) via Google, allowing users to sign in or register with a single click.

Authentication Flow

+----------+              +------------+              +-----------------+
| Browser  | ------------ |  Firebase  | ------------ |  Google OAuth   |
+----------+              +------------+              +-----------------+
     |                          |                              |
     | 1. Click "Sign in"       |                              |
     |------------------------> |                              |
     |                          | 2. Perform OAuth Consent     |
     |                          |----------------------------> |
     |                          | 3. ID Token Returned         |
     |                          |<---------------------------- |
     | 4. Receive Firebase JWT  |                              |
     |<-------------------------|                              |
     |                                                         |
     | 5. POST /api/auth/google { idToken }                    |
     |-------------------------------------------------------->|
     |                                                         |
     | 6. Validate Token & Issue `go_session` Cookie           |
     |<--------------------------------------------------------|

1. Client-Side Trigger: The user clicks Continue with Google on the login or registration modal.
2. Google OAuth Popup: Firebase Web SDK manages the OAuth popup flow and Google account consent.
3. ID Token Generation: Upon authorization, Firebase issues a signed OpenID Connect (OIDC) JWT to the browser.
4. Backend Verification: The browser submits the JWT to POST /api/auth/google. The GO backend cryptographically verifies the token's signature, issuer, and audience against Google's public certificates.
5. Session Established: The backend issues the standard go_session cookie, seamlessly authenticating the user.

Automatic Account Linking

A key design feature in GO Shortener is Safe Account Linking:

Linking Logic:

1. The backend extracts the verified email address and Firebase UID from the validated Google token.
2. It queries the users table for an existing record matching that email address.
3. If found:
   • Sets firebase_uid = token.UID
   • Sets auth_provider = "google" (or hybrid)
   • Updates last_login_at = CURRENT_TIMESTAMP
4. If not found:
   • Creates a new user row with email, first_name, last_name, and auth_provider = "google".
   • The user immediately inherits the normal registered user quota (100 links/month).