Google App Engine suddenly started failing endpoints authentications

Question

I have an an app on Google App Engine with both an iOS and Android client that communicates with the server via Google Cloud Endpoints, and at some time yesterday between 19:21 and 20:24 (server time, so I assume Pacific), EVERY request to my server via Endpoints, regardless of which client it came from, has failed with:

D 2014-05-12 20:24:33.353 Checking for id_token.
D 2014-05-12 20:24:33.362 Cert cache miss
D 2014-05-12 20:24:34.705 id_token verification failed.
D 2014-05-12 20:24:34.706 Checking for oauth token.
D 2014-05-12 20:24:34.717 Oauth framework user didn't match oauth token user.

I have not made any modifications to my app since May 8th, so something must have changed on the App Engine side.

FWIW, my app uses endpoints-proto-datastore, in case that's relevant (though I doubt it is.)

This has rendered my service completely useless, and I'm not sure how to escalate this. Any tips on either how I might fix this or how I can escalate to Google?

Answer 1

In my case this was a bug of the GAE. Here are the issue trackers from the GAE: This ticket was fixed and now it works fine on my GAE instance. The second ticket is an "newer" ticket but with the same impact that the GAE cant can verify the token id.

Maybe it should work now on all instances :)

https://code.google.com/p/googleappengine/issues/detail?id=9188

https://code.google.com/p/googleappengine/issues/detail?id=10753

Answer 2

I too have same problem and have debugged as best I can, using Xcode debug to extract token and append to following https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=, which does validate token_id: "issuer": "accounts.google.com", "issued_to": ".apps.googleusercontent.com", "audience": ".apps.googleusercontent.com", "user_id": "*", "expires_in": 3226, "issued_at": 1400114068, ....

So it looks like GAE is issue. I'm using scope =...googleapis.com/auth/userinfo.email"; // scope for OAuth2 and there are some notes on https://developers.google.com/+/api/auth-migration#email, saying that going with timetable of 1st Sept 2014

But I don't see why it is dead now