Does Firebase verifyIdToken() needs a call to Firebase API for each new token when is cached?

Question

I'm using Firebase in a project where I use Firebase token ID as bearer token to authenticate user.

Project works ok but I want to know how works verifyIdToken() when is cached.

Now, the project works in this way:

1. Client log into client APP and retrieve a Firebase tokenId
2. Client call server using tokenId as Bearer token to be authorized.
3. Server uses verifyIdToken() to verify user.

The question is related about verifyIdToken() method and if is neccesary call Firebase API on each new token.

I've read this question where says:

VerifyIdToken() is also optimized for performance. It caches the Firebase token public cert (valid for 6 hours) which is used to validate the token signature on local machine. No RPC is involved except for downloading the public cert.

Also, this answer says:

When you call verifyIdToken, the Admin SDK decodes the token with the public key and verifies that the signature is valid. It downloads this key from Google's servers, but it's cached for 24 hours

And the comment:

verifyIdToken() fetches public keys from Google servers. But these get cached up to 24 hours, and so the RPC call overhead gets amortized.

But, what cert is downloaded and cached? From user or project?

So, do server needs a call to Firebase API on each new tokenId getting from the client or can the server decode without internet connection using cached cert?

The main goal is to decrease number of calls to Firebase API, so I want to know if with perm cached downloaded every 24h, server can decode every valid token for the project without internet.

Thanks in advance.

Answer 1

But, what cert is downloaded and cached? From user or project?

ID token is signed with a private key. SDK needs to fetch the corresponding public key certificate to verify the signature. This comes from https://www.googleapis.com/robot/v1/metadata/x509/[email protected]

So, do server needs a call to Firebase API on each new tokenId getting from the client or can the server decode without internet connection using cached cert?

Server needs to be able to fetch the public key certificate when it verifies a token for the first time. Then it can operate without a connection as long as the cached certificate remains valid (up to 24 hours). But this is not something you have any control over, so you shouldn't rely on it.

The main goal is to decrease number of calls to Firebase API, so I want to know if with perm cached downloaded every 24h, server can decode every valid token for the project without internet.

This depends on how your server is implemented and deployed. The public key cache is tied to an Auth object instance created by the SDK. If your server is persistent, the Auth instance will stay in memory and so will the cache. In this scenario you can expect the server to make about 1 rpc every 24 hours (the same cached certificate is used to verify all tokens).

But if your server is ephemeral (e.g. Cloud Functions), then the Auth instance is going to get created and cleaned up many times over. In a deployment like this, cache is not going to make a big difference, and the server will end up making an rpc pretty much for every invocation of the server.