idtoken: Using NewValidator with Google credentials in the environments means you can't validate tokens

[peterwillis]

Environment details

• Programming language: Go
• OS: Linux
• Language runtime version: 1.17
• Package version: v0.54.0

Steps to reproduce

When I create a validator with idtoken.NewValidator(ctx) and then use v.Validate(ctx, "valid token", "valid audience") there is an error that shows the certs endpoint is returning a 400. I think this is because library picks up GOOGLE_APPLICATION_CREDENTIALS in the environment and adds an authorization header to the request made to the certs endpoint at https://www.googleapis.com/oauth2/v3/certs which is not accepted as it's invalid to pass credentials to that public endpoint.

If I don't use NewValidator and instead use idtoken.Validate(ctx, "valid token", "valid audience") then I can see the code is picking http.DefaultClient and not adding any authorization headers and everything works.

That means I have to create a validator explicitly overriding the http.Client with idtoken.NewValidator(ctx, idtoken.WithHTTPClient(http.DefaultClient)). This seems counter intuitive.

[codyoss]

Hey @peterwillis thanks for the report. This looks similar to #785 but I will take another look.

[codyoss]

Out of curiosity are you passing any options? I am curious to hear your use case. If you are passing other options also passing option.WithoutAuthentication() may be a good workaround for you for now.

[peterwillis]

Ok I see it now in the docs:

NewValidator creates a Validator that uses the options provided to configure a the internal http.Client that will be used to make requests to fetch JWKs.

The only reason to use NewValidator is to override the http.Client. I think a note that explains it will pick up the credentials in the standard way in a GCE environment would be super helpful.

I will use idtoken.Validate instead. Thank you!

[peterwillis]

I have been thinking about this, and I realised that the reason I chose to use NewValidator for my use case in the first place is so that I could get more test coverage by passing in an http client that doesn't actually make the request. Using the idtoken.Validate function means that this is no longer possible.

[codyoss]

@peterwillis You are right, this should be a bug. I opened a PR to fix this issue.