Google returns the following claimed id for a particular user for my realm http://localhost:59674:
https://www.google.com/accounts/o8/id?id=AItOawlikYtWr5FCO2mzN1ydORX5S4NFZg1H2Y4
Do I need the whole string to uniquely identify a Google user? Is it sufficient if I just take the id portion of the query string, ie all after “?id=”?
My next question is: what is the range of possible characters after “?id=”? Will it always be [A-Za-z0-9]?
Thanks.
Yes, you need to store the entire claimed identifier for each user (be sure that your user table is case sensitive for this column!).
The set of allowed characters in this URL is any unreserved URL character, so it can absolutely be more than just alphanumerics. This means, I believe, unicode characters may also appear in the URL. Although the browser typically displays these characters as escaped for security reasons, the raw URL itself needn’t escape these characters.