이 값은 사용자 이름을 표시하여 앱을 개인화하거나, ID를 다른 페이지로 전달하거나, 로그에 사용량 데이터를 캡처할 때 유용할 수 있습니다.
사용자 로그인 지우기
다음 매개변수 값은 IAP 로그인 쿠키를 지웁니다.
YOUR_APP_URL?gcp-iap-mode=CLEAR_LOGIN_COOKIE
이 매개변수를 전달하면 앱의 모든 IAP 발급 쿠키가 삭제되고 브라우저가 YOUR_APP_URL로 이동합니다. 브라우저에 앱의 ID 공급업체(IdP)가 있는 유효한 세션이 있는 경우 IdP에 사용 중인 계정이 하나뿐이면 자동 로그인이 발생할 수 있습니다. 사용 중인 계정이 여러 개인 경우 프로필 전환을 허용하는 계정 선택 페이지가 열립니다.
JWT 인증 테스트
IAP는 무효 JWT를 테스트 웹페이지로 전달하여 JWT 인증 로직을 테스트하는 데 도움이 됩니다.
예를 들어 IAP는 쿼리 매개변수 gcp-iap-mode=SECURE_TOKEN_TEST 및 iap-secure-token-test-type=SIGNATURE가 포함된 요청에 잘못된 서명이 있는 JWT를 전달합니다.
인증 로직에서 해당 무효 서명을 발견해야 합니다.
요청에 적절한 매개변수를 추가하여 다음 시나리오에 대해 인증 로직을 테스트할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eIAP query parameters, specifically \u003ccode\u003egcp-iap-mode\u003c/code\u003e, can be used to perform actions like retrieving user identity or clearing the login cookie.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcp-iap-mode=IDENTITY\u003c/code\u003e parameter provides a JSON dictionary with the user's email and sub information, which can be used for personalization or data capture, even if the user lacks app access.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcp-iap-mode=CLEAR_LOGIN_COOKIE\u003c/code\u003e parameter can be used to clear all IAP-issued cookies for the app, potentially prompting a re-authentication process.\u003c/p\u003e\n"],["\u003cp\u003eIAP facilitates JWT verification testing using \u003ccode\u003egcp-iap-mode=SECURE_TOKEN_TEST\u003c/code\u003e along with parameters to simulate different invalid JWT scenarios, such as incorrect signatures or expiration dates.\u003c/p\u003e\n"],["\u003cp\u003eThe presence of the \u003ccode\u003eX-Goog-IAP-Generated-Response\u003c/code\u003e HTTP header indicates that a response originated from IAP, allowing applications to differentiate between IAP-generated errors and application-generated errors.\u003c/p\u003e\n"]]],[],null,["# Using query parameters and headers\n\nThis page describes how to use Identity-Aware Proxy (IAP)\nquery parameters and headers to enhance your application UI or provide\ntroubleshooting options.\n\nQuery Parameters\n----------------\n\nDifferent actions can be performed by setting the parameter `gcp-iap-mode` in the URL query string.\nThese query parameters can be included with any path, not just the root URL.\n\n### Passing user identity\n\nPassing the following parameter value returns a JSON dictionary with the user's identity:\n\n\u003cvar translate=\"no\"\u003eYOUR_APP_URL\u003c/var\u003e`?gcp-iap-mode=IDENTITY`\n\nThis is available from any signed-in Google account, even if the account\ndoesn't have access to the app. You can navigate to the URL directly or you can\nreference it to make requests to the URL. Following is an example value returned\nby the URL:\n\n`{\"email\":\"accounts.google.com:`\u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e`\",\"sub\":\"accounts.google.com:118133858486581853996\"}`\n\nYou might find this value useful to personalize your app, such as by displaying\nthe user's name, to pass identity to another page, or capture usage data in\nlogs.\n\n### Clearing user login\n\nThe following parameter value clears the IAP login cookie:\n\n\u003cvar translate=\"no\"\u003eYOUR_APP_URL\u003c/var\u003e`?gcp-iap-mode=CLEAR_LOGIN_COOKIE`\n\nPassing this parameter clears all the IAP-issued cookies\nfor your app and navigates the browser to `YOUR_APP_URL`. If your browser has a\nvalid session with the identity provider (IdP) of your app, a silent sign-in\nmight happen when there is only one account in use with the IdP. If there are\nmultiple accounts in use, an account selection page opens to allow profile switching.\n\n### Testing JWT verification\n\nIAP helps you test your JWT verification logic by passing\ninvalid JWTs to testing webpages.\n\nFor example, IAP passes a JWT with an invalid signature\nfor any request that contains the query parameters\n`gcp-iap-mode=SECURE_TOKEN_TEST` and `iap-secure-token-test-type=SIGNATURE`.\nYour verification logic should catch the invalid signature.\n\nYou can test your verification logic against any of the following scenarios by\nappending the appropriate parameters to a request.\n\nSpecial headers\n---------------\n\n### Detecting responses from IAP\n\nWhen IAP generates an HTTP response, such as when it denies\naccess (403) or requests authentication (302 or 401), it adds the\n`X-Goog-IAP-Generated-Response` HTTP response header. By detecting the presence\nof this header, you can perform actions like:\n\n- Distinguish between error messages generated by IAP and error\n messages generated by your application.\n\n- Detect when IAP credentials need to be added to a\n request."]]
