Custom Authentication with Firebase and Generating JWT

Question

I am integrating Firebase with my existing Authentication in Android app. As per Firebase documentation, below steps needs to be followed to achieve authentication

Generating a Secure Token on a Secure Server
Authenticating Clients

I am confused in generating a secure token, Do I need to generate it on a secure server? What does it meant? I am thinking of generating the token in the android client itself.

Let me explain my existing Authentication mechanism, After getting credentials as input it will check against MongoDB which is connected with MongoLab API through Retrofit

After this, I am thinking of integrating with Firebase in the below way

From Login User UID which I get after successful login and in the android client itself I will generate a Secure Token (JWT).
With the generated JWT, I will again authenticate a client (Second time with firebase, as Initially with my existing authentication mechanism)

Generating Secure Token (JWT)

Map<String, Object> payload = new HashMap<String, Object>();

payload.put("uid", "uniqueId1");
payload.put("some", "arbitrary");
payload.put("data", "here");

TokenGenerator tokenGenerator = new TokenGenerator("<YOUR_FIREBASE_SECRET>");
String token = tokenGenerator.createToken(payload);

Authenticating Clients

Firebase ref = new Firebase("https://<YOUR-FIREBASE-APP>.firebaseio.com/");

ref.authWithCustomToken(token, new Firebase.AuthResultHandler() {
    @Override
    public void onAuthenticationError(FirebaseError error) {
       System.err.println("Login Failed! " + error.getMessage());
    }

    @Override
    public void onAuthenticated(AuthData authData) {
        System.out.println("Login Succeeded!");
    }
});

Here it looks like a round trip, like Authenticating a User 2 times, with my existing authentication and again with Firebase Custom Authentication. Is there any better way to achieve the above process?

bojeil bojeil · Accepted Answer · 2017-12-06T08:59:57

The custom token has to be generated on a backend server. Generating it on the client side will expose your project credentials compromising your entire users. Any attacker who can install your app will be able to figure out your service account credentials and have full access to your users.

Custom Authentication with Firebase and Generating JWT

1 Answers