angular - Firebase SDK token 验证错误 : auth/argument-error

Question

我正在使用带有 firebase 的 Angular 应用程序工作，并且在云函数中使用 firebase SDK 验证 idToken 时遇到困难。

当我尝试调用 protected 端点时开始，用户必须经过身份验证才能访问它，但是当我与经过身份验证的用户进行调用时，它没有成功。

首先，我检查functions:log 以查看我在身份验证失败时记录的错误消息。

2018-07-18T13:10:11.575Z E api: Error while verifying Firebase ID token:  { Error: Decoding Firebase ID token failed. Make sure you passed the entire string JWT which represents an ID token. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.
    at FirebaseAuthError.Error (native)
    at FirebaseAuthError.FirebaseError [as constructor] (/user_code/node_modules/firebase-admin/lib/utils/error.js:39:28)
    at FirebaseAuthError.PrefixedFirebaseError [as constructor] (/user_code/node_modules/firebase-admin/lib/utils/error.js:85:28)
    at new FirebaseAuthError (/user_code/node_modules/firebase-admin/lib/utils/error.js:143:16)
    at FirebaseTokenVerifier.verifyJWT (/user_code/node_modules/firebase-admin/lib/auth/token-verifier.js:136:35)
    at FirebaseTokenGenerator.verifyIdToken (/user_code/node_modules/firebase-admin/lib/auth/token-generator.js:129:37)
    at Auth.verifyIdToken (/user_code/node_modules/firebase-admin/lib/auth/auth.js:124:37)
    at validateFirebaseIdToken (/user_code/lib/routes/employee/employeeRoute.js:29:18)
    at Layer.handle [as handle_request] (/user_code/node_modules/express/lib/router/layer.js:95:5)
    at next (/user_code/node_modules/express/lib/router/route.js:137:13)  errorInfo: 
   { code: 'auth/argument-error',
     message: 'Decoding Firebase ID token failed. Make sure you passed the entire string JWT which represents an ID token. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.' },
  codePrefix: 'auth' }

所以我检查了我是如何获得 token 的，它似乎没问题:

  public async getIdToken() {
    return this.angularFireAuth.auth.currentUser.getIdToken(true)
      .then(idToken => {
        return idToken
      })
      .catch(err => {
        throw new Error(err)
      })
  }

以及我如何验证它，似乎也很好(对我来说)

const validateFirebaseIdToken = (req, res, next) => {
  console.log('Check if request is authorized with Firebase ID token')

  if ((!req.headers.authorization || !req.headers.authorization.startsWith('Bearer ')) && !(req.cookies && req.cookies.__session)) {
    console.error('No Firebase ID token was passed as a Bearer token in the Authorization header.',
      'Make sure you authorize your request by providing the following HTTP header:',
      'Authorization: Bearer <Firebase ID Token>',
      'or by passing a "__session" cookie.')
    res.status(403).send('Unauthorized')
    return
  }

  let idToken
  if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
    console.log('Found "Authorization" header')
    idToken = req.headers.authorization.split('Bearer')[1]
  } else if(req.cookies) {
    console.log('Found "__session" cookie')
    idToken = req.cookies.__session
  } else {
    console.log('No cookie')
    res.status(403).send('Unauthorized')
    return
  }

  admin.auth().verifyIdToken(idToken)
    .then(decodedIdToken => {
      console.log('ID token correctly decoded', decodedIdToken)
      return next()
    })
    .catch(error => {
      console.error('Error while verifying Firebase ID token: ', error)
      res.status(403).send('Unauthorized')
    })

}

所以我记录了 中返回的 idToken getIdToken 函数和之前的 idToken admin.auth().verifyIdToken(idToken) 被调用并且它们完美匹配。

所以我不明白为什么它会失败。

我已经检查了文档，它似乎与我所做的相符 https://firebase.google.com/docs/auth/admin/verify-id-tokens

任何想法将不胜感激。

Answer 1

卡洛斯来了

我认为这个过程很好，但是当你拆分标题时， token 中可能会有一个额外的空间:

if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
    console.log('Found "Authorization" header')
    idToken = req.headers.authorization.split('Bearer')[1] // <- this part has a space at the beginning
}

修剪字符串可以帮助您解决问题吗？