Unable to decode Firebase JWT

Question

I am creating a web application and I want to implement Firebase authentication and help users to login using Google, Facebook or Twitter.

Users login using Firebase on my website I receive login information in my Javascript.

As per Firebase documentation, instead of passing UID received in the JS, I send the token id to the backend server so that it can authenticate the source and retrieve the user id.

I use PHP-JWT to check and validate the token returned by Firebase. However, the Key ID in the header is not matching with any of the Key ID defined in https://www.googleapis.com/robot/v1/metadata/x509/[email protected] where, as per the verification document, is where I can find the public keys.

Answer 1

Can you print out the 'iss' and 'exp' fields in the Firebase token payload when your server can not validate the token? The issuer ('iss') should start with https://securetoken.google.com/, and the issued time ('iat') should be 1-2 seconds earlier than your system time when your server received the token.