如何验证 Firebase ID 令牌

Question

我正在按照这个 https://firebase.google.com/docs/auth/admin/verify-id-tokens 检索客户端中的 idToken 并在服务器上验证它。

在服务器端，我使用以下Java代码来初始化SDK并验证令牌：

  String json = // JSON generated from Firebase service account;
  ByteArrayInputStream serviceAccount =
      new ByteArrayInputStream(json.getBytes(Charsets.UTF_8));

  FirebaseOptions options =
      new FirebaseOptions.Builder()
          .setCredentials(GoogleCredentials.fromStream(serviceAccount))
          .setDatabaseUrl() // My database url
          .build();
  FirebaseApp defaultApp = FirebaseApp.initializeApp(options);
  FirebaseAuth defaultAuth = FirebaseAuth.getInstance(defaultApp);
  try {
      FirebaseToken firebaseToken = Tasks.await(
             defaultAuth.verifyIdToken(tokenFromClient));
      System.out.println("token email " + firebaseToken.getEmail());
      System.out.println("Successfully verify token");
  } catch (Exception e) {
      System.out.println("token verify error " + e);
  }

我遇到了这个错误

java.util.concurrent.ExecutionException: com.google.firebase.auth.FirebaseAuthException: Error while verifying token signature.

有来自 SDK 的深度堆栈跟踪 API:

Caused by: com.google.firebase.auth.FirebaseAuthException: Error while verifying token signature.
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifyTokenAndSignature(FirebaseTokenVerifier.java:152)
    at com.google.firebase.auth.FirebaseAuth.call(FirebaseAuth.java:223)
    at com.google.firebase.auth.FirebaseAuth.call(FirebaseAuth.java:211)
    at com.google.firebase.tasks.Tasks.run(Tasks.java:82)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThreadFactory.run(ApiProxyImpl.java:1233)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThreadFactory.run(ApiProxyImpl.java:1227)
    at java.lang.Thread.run(Thread.java:745)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThread.run(ApiProxyImpl.java:1194)

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1953)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:220)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1379)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1407)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
    at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:104)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:981)
    at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.refresh(GooglePublicKeysManager.java:172)
    at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.getPublicKeys(GooglePublicKeysManager.java:140)
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifySignature(FirebaseTokenVerifier.java:174)
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifyTokenAndSignature(FirebaseTokenVerifier.java:146)
    ... 10 more

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1473)
    ... 26 more

在客户端，我在获取id token的时候设置了force refresh为true，所以我认为id token还没有过期。

感谢任何帮助。

Answer 1

根本原因是错误的证书。我们的服务器是基于App Engine构建的，但是我们根据项目需要更换了证书。证书问题修复后，token验证成功

如何验证 Firebase ID 令牌

How to verify Firebase id token

java

firebase

firebase-authentication

firebase-admin