Login with Google (OAuth 2.0) in PHP and Node.js

composer require google/apiclient

<?php
// /auth/google
require __DIR__ . '/../vendor/autoload.php';

session_set_cookie_params(['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
session_start();

$client = new Google\Client();
$client->setClientId(getenv('GOOGLE_CLIENT_ID'));
$client->setClientSecret(getenv('GOOGLE_CLIENT_SECRET'));
$client->setRedirectUri(getenv('GOOGLE_REDIRECT_URI'));
$client->setScopes(['openid', 'email', 'profile']);

$state = bin2hex(random_bytes(16));
$_SESSION['oauth_state'] = $state;
$client->setState($state);

header('Location: ' . $client->createAuthUrl());
exit;

<?php
// /auth/google/callback
require __DIR__ . '/../vendor/autoload.php';

session_set_cookie_params(['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
session_start();

$expected = $_SESSION['oauth_state'] ?? '';
unset($_SESSION['oauth_state']);
if ($expected === '' || !hash_equals($expected, $_GET['state'] ?? '')) {
    http_response_code(400);
    exit('Invalid state');
}
if (empty($_GET['code'])) {
    http_response_code(400);
    exit('Missing code');
}

$client = new Google\Client();
$client->setClientId(getenv('GOOGLE_CLIENT_ID'));
$client->setClientSecret(getenv('GOOGLE_CLIENT_SECRET'));
$client->setRedirectUri(getenv('GOOGLE_REDIRECT_URI'));

try {
    $token = $client->fetchAccessTokenWithAuthCode($_GET['code']);
    if (isset($token['error'])) {
        throw new RuntimeException($token['error_description'] ?? 'Token exchange failed');
    }

    // Checks the signature, issuer, audience and expiry
    $payload = $client->verifyIdToken($token['id_token'] ?? '');
    if (!$payload || empty($payload['email_verified'])) {
        throw new RuntimeException('Invalid ID token or unverified email');
    }

    $user = findOrCreateUserByGoogleSub(
        $payload['sub'],
        $payload['email'],
        $payload['name'] ?? '',
        $payload['picture'] ?? null
    );

    session_regenerate_id(true);   // new session ID after login
    $_SESSION['user_id'] = $user->id;
    header('Location: /dashboard');
    exit;
} catch (Throwable $e) {
    error_log('Google sign-in failed: ' . $e->getMessage());
    header('Location: /login?error=oauth');
    exit;
}

npm install express express-session passport passport-google-oauth20

// auth.js
import passport from 'passport';
import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
import { findOrCreateUserByGoogleSub, findUserById } from './users.js';

passport.use(new GoogleStrategy(
  {
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: process.env.GOOGLE_CALLBACK_URL,
    scope: ['openid', 'email', 'profile'],
    state: true,   // random state stored in the session and checked on return
    pkce: true,    // adds a PKCE code challenge (requires state)
  },
  async (accessToken, refreshToken, profile, done) => {
    try {
      const email = profile.emails?.[0];
      if (!email?.verified) return done(null, false);
      const user = await findOrCreateUserByGoogleSub(
        profile.id, email.value, profile.displayName, profile.photos?.[0]?.value);
      done(null, user);
    } catch (err) {
      done(err);
    }
  }
));

passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser(async (id, done) => {
  try { done(null, await findUserById(id)); } catch (err) { done(err); }
});

// app.js
import express from 'express';
import session from 'express-session';
import passport from 'passport';
import './auth.js';

const app = express();
app.set('trust proxy', 1);   // needed for secure cookies behind a proxy

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true, sameSite: 'lax', maxAge: 24 * 60 * 60 * 1000 },
}));
app.use(passport.initialize());
app.use(passport.session());

app.get('/auth/google', passport.authenticate('google'));
app.get('/auth/google/callback',
  passport.authenticate('google', { failureRedirect: '/login?error=oauth' }),
  (req, res) => res.redirect('/dashboard'));

app.post('/logout', (req, res, next) => {
  req.logout(err => (err ? next(err) : req.session.destroy(() => res.redirect('/'))));
});

app.listen(process.env.PORT || 3000);

CREATE TABLE users (
    id             BIGSERIAL PRIMARY KEY,
    google_sub     VARCHAR(255) UNIQUE,        -- NULL for password-only users
    email          VARCHAR(255) NOT NULL,
    email_verified BOOLEAN NOT NULL DEFAULT FALSE,
    name           VARCHAR(255),
    picture        TEXT,
    password_hash  VARCHAR(255),               -- NULL for Google-only users
    created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
    last_login_at  TIMESTAMPTZ
);
CREATE INDEX idx_users_email ON users (email);