title: Basic Flask OpenID Connect example
body: <p>With the impending shutdown of Google's support for OpenID 2, anyone using a convenient library like <a href="https://pypi.python.org/pypi/Flask-GoogleAuth/0.3" rel="noreferrer">Flask-Googleauth</a> will have to migrate. There is a Flask library for OpenID Connect, called <a href="https://pypi.python.org/pypi/flask-oidc" rel="noreferrer">flask-oidc</a>. Unfortunately, there doesn't seem to be any info out there on how to use it. I looked for SO questions tagged <code>flask</code> and <code>openid-connect</code>, but found zero, hence this question. </p>
  
  <p>Here's what I've put together as a proof-of-concept use of flask-oidc. It's based on <a href="https://github.com/SteelPangolin/flask-oidc/blob/master/tests/app.py" rel="noreferrer">flask-oidc's app.py file</a>:</p>
  
  <pre><code>"""
  Flask app for testing the OpenID Connect extension.
  """
  from flask import Flask
  from flask.ext.oidc import OpenIDConnect
  
  def index():
      return "too many secrets", 200, {
          'Content-Type': 'text/plain; charset=utf-8'
      }
  
  def create_app(config, oidc_overrides=None):
      app = Flask(__name__)
      app.config.update(config)
      if oidc_overrides is None:
          oidc_overrides = {}
      oidc = OpenIDConnect(app, **oidc_overrides)
      app.route('/')(oidc.check(index))
      return app
  
  if __name__ == '__main__':
      APP = create_app({
          'OIDC_CLIENT_SECRETS': './client_secrets.json',
          'SECRET_KEY': 'secret'})
      APP.run(host="127.0.0.1", port=8080, debug=True)
  </code></pre>
  
  <p>After registering my application as described <a href="https://developers.google.com/accounts/docs/OpenIDConnect" rel="noreferrer">here</a>, this successfully sends the user to Google for authentication, and returns them to <code>http://127.0.0.1:8080/oidc_callback</code>, which then redirects them to <code>https://127.0.0.1:8080/</code>, but that then redirects the user back to Google for authentication, creating a redirect loop.</p>
  
  <p>My question, of course, is simple: how can I get an authenticated user to see that index page?</p>