Security: Validate Google OAuth token audience in web login flow

[fred-maina]

Description

The mobile Google OAuth flow validates the aud claim from Google tokeninfo before creating or logging in a user:

String audience = (String) body.get("aud");
if (audience == null || !googleOAuthProperties.getClientId().equals(audience)) {
    return new AuthResponse(false, "OAuth failed: Invalid token audience", null, null);
}

However, the standard web OAuth flow in AuthService.handleGoogleOAuth validates the id_token through Google tokeninfo, then immediately reads user identity fields such as email, given_name, and family_name without checking that the token audience matches this backend's configured Google client ID.

This creates inconsistent security behavior between mobile and web login. The backend should explicitly reject Google ID tokens whose aud claim does not match googleOAuthProperties.getClientId().

Why this matters

Without an audience check, a token issued for a different Google OAuth client could potentially be accepted by this backend if the token is otherwise valid. The mobile flow already handles this correctly, so the web flow should match it.

Affected area

• src/main/java/com/fredmaina/chatapp/Auth/services/AuthService.java
• Method: handleGoogleOAuth(String code, String redirectUri)

Acceptance Criteria

• After tokenInfo.getBody() is retrieved in handleGoogleOAuth, extract the aud claim.
• If aud is missing or does not equal googleOAuthProperties.getClientId(), return a failed AuthResponse with a safe message such as OAuth failed: Invalid token audience.
• Do not create or log in a user when the token audience is invalid.
• Add or update tests for:
  • Valid audience succeeds.
  • Missing audience fails.
  • Wrong audience fails.
• Keep behavior consistent with handleGoogleMobileOAuth.

Suggested implementation

Mirror the existing mobile OAuth check inside the web OAuth method before reading identity fields or creating the user.