How can I validate a Cloud Tasks OIDC token in my Java servlet handler?

Below is an example of how you can verify the OIDC token passed in the Authorization header in your servlet. Cloud Tasks attaches the OIDC token as a Bearer token, so you’ll need to:

1. Extract the token from the HTTP header.
2. Verify the token’s signature and claims (issuer, audience, etc.) using Google’s public certificates. This confirms that the token was indeed minted by Google for your service account.

A common approach is to use Google’s OAuth2 client libraries. For example, using Google’s Java library you can verify the token as follows:

---

Example: Validating the OIDC Token in a Servlet

JAVACopied
import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken;
import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.json.jackson2.JacksonFactory;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Collections;

@WebServlet(
    name = "Tasks",
    description = "Handle Cloud Tasks",
    urlPatterns = "/tasks/create"
)
public class TaskServlet extends HttpServlet {

  // TODO: Replace this with your service account email used to sign the token.
  private static final String SERVICE_ACCOUNT_EMAIL = "java-docs-samples-testing@java-docs-samples-testing.iam.gserviceaccount.com";
  private static final JacksonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();

  @Override
  public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    // Extract the Authorization header
    String authHeader = req.getHeader("Authorization");
    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
      resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing or invalid Authorization header.");
      return;
    }

    // Remove "Bearer " prefix
    String token = authHeader.substring("Bearer ".length()).trim();

    try {
      if (!verifyToken(token)) {
        resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token.");
        return;
      }
    } catch (GeneralSecurityException e) {
      resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Security error.");
      return;
    }

    // Continue processing the request if token is valid.
    resp.setStatus(HttpServletResponse.SC_OK);
    // Do some long running operation...
  }

  private boolean verifyToken(String token) throws GeneralSecurityException, IOException {
    // Create transport. In production, reuse the transport instance.
    var httpTransport = GoogleNetHttpTransport.newTrustedTransport();

    // Build verifier with expected audience (your service account email)
    GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(httpTransport, JSON_FACTORY)
        // Specify the allowed audience (in our case, the service account used to create the token)
        .setAudience(Collections.singletonList(SERVICE_ACCOUNT_EMAIL))
        // Optionally, you can enforce issuer if needed:
        // .setIssuer("https://accounts.google.com")
        .build();

    // Verify the token
    GoogleIdToken idToken = verifier.verify(token);
    return idToken != null;
  }
}

---

Key Points

• Extraction: The servlet extracts the token from the Authorization header. Cloud Tasks includes the token as a Bearer token.
• Verification: Using GoogleIdTokenVerifier, the code validates the token signature and checks that the audience matches your service account email.
  • You can also check additional claims like iss (issuer) if needed.
• Security: If the token is invalid or missing, the servlet responds with a 401 Unauthorized error.

Additional Considerations

• Dependencies: Make sure you include the Google OAuth client library in your project. For example, add the following to your Maven pom.xml:

XMLCopied
<dependency>
  <groupId>com.google.api-client</groupId>
  <artifactId>google-api-client</artifactId>
  <version>1.33.2</version>
</dependency>
<dependency>
  <groupId>com.google.oauth-client</groupId>
  <artifactId>google-oauth-client-jetty</artifactId>
  <version>1.33.2</version>
</dependency>

• No Additional Configurations Needed: There isn’t a separate configuration in your Google Cloud project that automatically validates the token for you. Validation must occur on your backend (or via a proxy) using code like the snippet above.

This example should help secure your task handler by ensuring that only authenticated requests (i.e., those sent by Cloud Tasks using the proper service account) are processed.