Response type "code" sends request for token instead of authorization code

With the responseType="code" the GoogleAuth.grantOfflineAccess method sends a request for a token. To check that, open the Network tab in the Google Chrome developer tools and login with your account. Here is an example of a request that the GoogleAuth.grantOfflineAccess method does:

https://accounts.google.com/o/oauth2/iframerpc?action=issueToken&response_type=token id_token&login_hint=<login-hint>&client_id=<client-id>&origin=http://localhost:3000&scope=openid profile email&ss_domain=http://localhost:3000

And the response is:

{"token_type":"Bearer",
"access_token":"<access-token>",
"scope":"email profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile opened",
"login_hint":"<login-hint>",
"expires_in":3599,
"id_token":"token-id-with-user-info",
"session_state":{"extraQueryParams":{"authuser":"0"}}}

At the same time, the onSuccess callback receives an object with an authorization code only. I know it’s not the react-google-login issue, but still, when you set the responseType to code you expect the access token to never appear on the client site.

[JekRock]

Just checked my assumption with the gapi.auth2.authorize and it returns the authorization code without setting anything to the session storage or making any additional requests. It would be nice to have the ability to use react-google-login for authorization only (yes, I know that the name of the library says “google-login” 😃 )

[JekRock]

@sepatin well, my opinion on that is if you need to get the authorization code only then don’t use any libraries and just redirect a user to the Google/Facebook sign-in page.