Firebase token verification on server

0
votes

I am trying to implement an authentication/authorization system using firebase and I am struggling with the last part of the authorization flow, which is, enabling my server to verify the validity of a token.

There are two ways to perform this:

  1. Validate the token using the Admin SDK of firebase, where essentially a server communicates with Firebase and validates a token (safe option)
  2. Validate the token using a third-party JWT library.

My question has to do with option (2), which according to documentation is perfectly feasible. The question is, how is this safe? Everything included in the token-validation process is public according to this:

Finally, ensure that the ID token was signed by the private key corresponding to the token's kid claim. Grab the public key from https://www.googleapis.com/robot/v1/metadata/x509/[email protected] and use a JWT library to verify the signature. Use

If the token is public, and the key for validating it is public, who guarantees that the token is genuine?

Probably there is something related to JWTs that I am missing?

PS. I have already implemented option (1) with remote validation, but this will significantly affect the application performance.

1
firebasefirebase-authenticationjwtjwt-auth

1 Answers

2
votes

You can verify validity of a token with the public key, but you can only create tokens with the private key.

As their names imply:

  • Your private key should only be used in trusted environments, such as your development machine, a server you control, or Cloud Functions. So those are the only places where you can generate auth tokens.

  • The public key however can be shared with others, which means that they can use it to ensure that the token is valid.