ملاحظة مُهمّة: اعتبارًا من 1 أيار (مايو) 2024، ستطلب شركة Apple بيانات الخصوصية والتوقيعات في تطبيقات iOS التي تستخدم حِزم SDK شائعة الاستخدام، بما في ذلك GoogleSignIn-iOS. يجب الترقية إلى الإصدار 7.1.0 من GoogleSignIn-iOS أو الإصدارات الأحدث قبل 1 أيار (مايو) 2024. اتّبِع دليل الترقية.
تنظيم صفحاتك في مجموعات
يمكنك حفظ المحتوى وتصنيفه حسب إعداداتك المفضّلة.
إذا كنت تستخدم ميزة "تسجيل الدخول باستخدام حساب Google" مع تطبيق أو موقع إلكتروني يتواصل مع خادم في الخلفية، قد تحتاج إلى تحديد المستخدم الذي سجّل الدخول حاليًا على الخادم.
لإجراء ذلك بأمان، بعد تسجيل دخول المستخدم بنجاح، أرسِل رمز هُوية
مستخدم إلى خادمك باستخدام بروتوكول HTTPS. بعد ذلك، على الخادم، تحقّق من سلامة
رمز التعريف واستخدِم معلومات المستخدم الواردة في الرمز لإنشاء
جلسة أو إنشاء حساب جديد.
تاريخ التعديل الأخير: 2025-07-25 (حسب التوقيت العالمي المتفَّق عليه)
[null,null,["تاريخ التعديل الأخير: 2025-07-25 (حسب التوقيت العالمي المتفَّق عليه)"],[[["\u003cp\u003eSecurely identify signed-in users on your server by sending their ID token via HTTPS after successful Google Sign-In, instead of using plain user IDs.\u003c/p\u003e\n"],["\u003cp\u003eVerify the integrity of the received ID token on your server to prevent impersonation and ensure security.\u003c/p\u003e\n"],["\u003cp\u003eEstablish a user session or create a new account based on the verified user information from the ID token payload.\u003c/p\u003e\n"],["\u003cp\u003eLeverage Cross Account Protection to receive security alerts from Google and enhance the security of your users' accounts by taking appropriate actions.\u003c/p\u003e\n"]]],[],null,["If you use Google Sign-In with an app or site that communicates with a backend\nserver, you might need to identify the currently signed-in user on the server.\nTo do so securely, after a user successfully signs in, send the user's\nID token to your server using HTTPS. Then, on the server, verify the integrity\nof the ID token and use the user information contained in the token to establish\na session or create a new account.\n| **Warning:** Do not accept plain user IDs, such as those you can get with the `GIDGoogleUser.userID`` property`, on your backend server. A modified client application can send arbitrary user IDs to your server to impersonate users, so you must instead use verifiable ID tokens to securely get the user IDs of signed-in users on the server side.\n\nSend the ID token to your server\n\nAfter a user successfully signs in, get the user's ID token:\n\nSwift \n\n```swift\nGIDSignIn.sharedInstance.signIn(withPresenting: self) { signInResult, error in\n guard error == nil else { return }\n guard let signInResult = signInResult else { return }\n\n signInResult.user.refreshTokensIfNeeded { user, error in\n guard error == nil else { return }\n guard let user = user else { return }\n\n let idToken = user.idToken\n // Send ID token to backend (example below).\n }\n}\n```\n\nObjective-C \n\n```objective-c\n[GIDSignIn.sharedInstance signInWithPresentingViewController:self\n completion:^(GIDSignInResult * _Nullable signInResult,\n NSError * _Nullable error) {\n if (error) { return; }\n if (signInResult == nil) { return; }\n\n [signInResult.user refreshTokensIfNeededWithCompletion:^(GIDGoogleUser * _Nullable user,\n NSError * _Nullable error) {\n if (error) { return; }\n if (user == nil) { return; }\n\n NSString *idToken = user.idToken;\n // Send ID token to backend (example below).\n }];\n}];\n```\n\nThen, send the ID token to your server with an HTTPS POST request:\n\nSwift \n\n```swift\nfunc tokenSignInExample(idToken: String) {\n guard let authData = try? JSONEncoder().encode([\"idToken\": idToken]) else {\n return\n }\n let url = URL(string: \"https://yourbackend.example.com/tokensignin\")!\n var request = URLRequest(url: url)\n request.httpMethod = \"POST\"\n request.setValue(\"application/json\", forHTTPHeaderField: \"Content-Type\")\n\n let task = URLSession.shared.uploadTask(with: request, from: authData) { data, response, error in\n // Handle response from your backend.\n }\n task.resume()\n}\n```\n\nObjective-C \n\n```objective-c\nNSString *signinEndpoint = @\"https://yourbackend.example.com/tokensignin\";\nNSDictionary *params = @{@\"idtoken\": idToken};\n\nNSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:signinEndpoint];\n[request setValue:@\"application/x-www-form-urlencoded\" forHTTPHeaderField:@\"Content-Type\"];\n[request setHTTPMethod:@\"POST\"];\n[request setHTTPBody:[self httpBodyForParamsDictionary:params]];\n\nNSOperationQueue *queue = [[NSOperationQueue alloc] init];\n[NSURLConnection sendAsynchronousRequest:request\n queue:queue\n completionHandler:^(NSURLResponse *response, NSData *data, NSError *error) {\n if (error) {\n NSLog(@\"Error: %@\", error.localizedDescription);\n } else {\n NSLog(@\"Signed in as %@\", data.bytes);\n }\n }];\n```\n\nVerify the integrity of the ID token\n\nAfter you receive the ID token by HTTPS POST, you must verify the integrity\nof the token.\n\nCreate an account or session\n\nAfter you have verified the token, check if the user is already in your user\ndatabase. If so, establish an authenticated session for the user. If the user\nisn't yet in your user database, create a new user record from the information\nin the ID token payload, and establish a session for the user. You can prompt\nthe user for any additional profile information you require when you detect a\nnewly created user in your app.\n\nSecuring your users' accounts with Cross Account Protection\n\nWhen you rely on Google to sign in a user, you'll automatically benefit from all of the\nsecurity features and infrastructure Google has built to safeguard the user's data. However,\nin the unlikely event that the user's Google Account gets compromised or there is some other\nsignificant security event, your app can also be vulnerable to attack. To better protect your\naccounts from any major security events, use [Cross Account\nProtection](/identity/protocols/risc) to receive security alerts from Google. When you receive these events, you\ngain visibility into important changes to the security of the user's Google account and\nyou can then take action on your service to secure your accounts."]]
