Detecting if account selected via AccountPicker is still valid without GET_ACCOUNTS permission

Question

In my app I use AccountPicker.newChooseAccountIntent() to get the user to select an account and then use GoogleAuthUtil.getToken() to obtain an auth token for that account.

This is all done without requiring the GET_ACCOUNTS permission on Marshmallow.

The problem I have after moving to API 23 is that I cannot detect when the selected account is no longer valid because AccountManager.getAccountsByType() returns an empty list for google accounts as I do not have the GET_ACCOUNTS permission.

It is quite annoying to have the ability to select and authenticate using a google account without GET_ACCOUNTS, but lack the ability to detect when the account is no longer valid.

Does anyone know how to detect when the account is no longer valid?

Answer 1

You shouldn't be using GoogleAuthUtil.getToken() at all, nor AccountPicker.newChooseAccountIntent(). As per the Improving the Security and User Experience of your Google Sign In Implementation blog post, getToken() is vulnerable to a token substitution attack.

You should follow the migration guide to use Google Sign In and the requestIdToken() flow. This allows you to 1) know what account is signed in 2) know when that account is no longer valid and 3) still get tokens needed to authenticate with Google services.