Sign in with Google

Overview

With Sign in with Google, the sign-in and sign-up forms of your site show a Continue with Google button. Your visitors sign in with their Google account in one click:

• No password to remember and no verification code to wait for: Google already confirmed their email address.
• New visitors get an account on the spot, if you allow it.
• Members who already have an account with the same email sign in to it.

You set it up in Dbmovies › Settings › Integrations. It is free, and it only needs a Client ID from Google.

What you need

• A Google account to sign in to Google Cloud.
• Your site on HTTPS. Google only accepts secure addresses, except localhost.
• A theme that shows the button. Wovie shows it on the sign-in and sign-up forms.

Create your Client ID

1. Go to Google Cloud Console and create a project, or choose one you already have.
2. Open APIs & Services › Credentials.
3. If Google asks you to configure the consent screen, do it first:
   • App name: the name your visitors see when they sign in, usually the name of your site.
   • Support email: an address of yours.
   • Audience: External.
4. Click Create credentials › OAuth client ID, and choose Web application.
5. In Authorized JavaScript origins, click Add URI and paste the address of your site exactly as Dbmovies shows it in the settings, such as https://your-website.com. It includes https and, if your site uses it, www.
6. Leave Authorized redirect URIs empty: Dbmovies does not use them, and it does not need a client secret either.
7. Click Create and copy the Client ID. It ends with .apps.googleusercontent.com.
8. Publish the app. In the consent screen settings (Audience), set the publishing status to In production with Publish app. While the app is in testing, only the test users you list can sign in. Dbmovies only asks for the name, email and photo of your visitors, so Google does not need to review the app.

[SCREENSHOT_HERE: Google Cloud Console, creating an OAuth client ID of type Web application, with the Authorized JavaScript origins of the site]

Settings

In Dbmovies › Settings › Integrations, section Sign in with Google:

Below the switch, the settings show the address to paste in Authorized JavaScript origins.

Check that it works

1. Open your sign-in page in a private window.
2. Click Continue with Google and choose a Google account.
3. You land in the member account, signed in.

How the account is found

Every time someone signs in with Google, Dbmovies looks for their account in this order:

1. An account already connected to that Google account. They sign in to it.
2. An account with the same email address. The first time, Dbmovies connects it to Google, and they sign in to it. This also completes a sign-up that was started with that email and never confirmed with its code.
3. No account:
   • With Allow new accounts on, Dbmovies creates one with the name and email from Google, with the role of a regular member. It sends the welcome email, and the visitor lands in their new account.
   • With Allow new accounts off, the visitor sees: There is no account with this Google email. Sign up first.

New accounts follow the same rules as the sign-up form. If the Firewall verifies email addresses, a disposable address is rejected, and a blocked IP address cannot sign in with Google either.

The member account

In Account › Settings, members see a Google row with the connected address and the date it was connected.

• To connect Google to an existing account, the member signs in with the Google account that uses the same email as their account. There is no separate connect button.
• Accounts created with Google have no password. Google is their only way in until the member sets a password in their account settings, or with Forgot password. The first password does not ask for a current one. Changing the email of the account also needs a password of their own first.
• To disconnect Google, the member needs a password of their own, and confirms it. From then on, they sign in with their email and password.

[SCREENSHOT_HERE: Account › Settings in Wovie, with the Google row connected and the Disconnect Google form]

What is stored

Dbmovies stores the Google ID of the account, its email, name and photo address, and the date it was connected, in the profile of the user. It does not store any password or access key from Google, and it does not ask for anything else.

Security

• Each sign-in is verified on your server. Dbmovies checks the signature, issuer, recipient (your Client ID), expiry and verified email of the token that Google sends. Each token works once.
• The same limits as the forms apply: after 10 failed sign-ins or new accounts from the same IP address in 15 minutes, Google sign-in pauses for that address. See Firewall.
• Administrators can sign in with Google too, if their email is a Google account. Turn on 2-step verification in that Google account.

Troubleshooting