Fetching custom fields from auth object in Firebase

Question

I am trying to invalidate/revoke client's auth token when they sign on a different device. Initial auth-token is supplied through our server and not firebase (but uses the same secret key, hence works with firebase too).

For each user we save an associated password which gets passed as part of auth-token, when user switches the device - we issue a new password from the server and compare password to invalidate token on server. Firebase connection however still persists.

I am trying to store passwords on firebase for each user. This can then be updated every time we change the password at the backend and use it to invalidate the firebase token as well. However, I am not able to extract password from the auth object. Any ideas?

This is my firebase security rule.

 {
    "rules": {

      ".read": root.child('passwords').child(auth.uid).val() == auth.password,
      ".write": root.child('passwords').child(auth.uid).val() == auth.password

   }

}

Surprisingly, none of the custom field in auth object are present.

I've used this method with success. You're most likely not creating the JWT correctly. Please post the code you're using to create that. Are you using the FirebaseTokenGenerator library or something else? Docs — Anid Monsur
Thanks Anid for the reply. No, not using FirebaseTokenGenerator, using a custom JWT library. Should the auth object passed back in ref.authWithCustomToken reflect what is being parsed by firebase? I'll check again and post code if still facing issues. Thanks! — user2803751

Anid Monsur Anid Monsur · Accepted Answer · 2015-11-24T19:05:13

Whatever you put in the custom auth object would be available in security rules and would be part of the authData returned after authenticating on the client. When you're creating the JWT, you have to follow Firebase's specific rules, which are outlined here. The important part being that a d key contains the authentication data you want to make available. Here's basic example of what the payload might look like.

{
  "v": "0",
  "iat": 1448391639,
  "d": {
    "uid": "user1234",
    "password": "mySecretPassword" 
  }
}

http://jwt.io/ is a great tool for quickly creating JWTs for testing. If you use the payload above in conjunction with your Firebase secret, you should see the same payload within your auth data and security rules.

f.authWithCustomToken('eyJhbGciOiJIUz...', function(err, data) {
    if (err) {
        // Handle error
    } else {
        console.log(data.auth); // {uid: "userId1234", password: "mySecretPassword"}
    }
});

Fetching custom fields from auth object in Firebase

1 Answers