Firebase SDK 令牌验证错误：auth/argument-error

Question

我正在使用带有 firebase 的 Angular 应用程序工作，并且在云函数中使用 firebase SDK 验证 idToken 时遇到困难。

当我尝试呼叫受保护的端点时，它开始，用户必须经过身份验证才能访问它，但是当我与经过身份验证的用户进行呼叫时，它没有成功。

首先，我检查 functions:log 以查看身份验证失败时记录的错误消息。

2018-07-18T13:10:11.575Z E api: Error while verifying Firebase ID token:  { Error: Decoding Firebase ID token failed. Make sure you passed the entire string JWT which represents an ID token. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.
    at FirebaseAuthError.Error (native)
    at FirebaseAuthError.FirebaseError [as constructor] (/user_code/node_modules/firebase-admin/lib/utils/error.js:39:28)
    at FirebaseAuthError.PrefixedFirebaseError [as constructor] (/user_code/node_modules/firebase-admin/lib/utils/error.js:85:28)
    at new FirebaseAuthError (/user_code/node_modules/firebase-admin/lib/utils/error.js:143:16)
    at FirebaseTokenVerifier.verifyJWT (/user_code/node_modules/firebase-admin/lib/auth/token-verifier.js:136:35)
    at FirebaseTokenGenerator.verifyIdToken (/user_code/node_modules/firebase-admin/lib/auth/token-generator.js:129:37)
    at Auth.verifyIdToken (/user_code/node_modules/firebase-admin/lib/auth/auth.js:124:37)
    at validateFirebaseIdToken (/user_code/lib/routes/employee/employeeRoute.js:29:18)
    at Layer.handle [as handle_request] (/user_code/node_modules/express/lib/router/layer.js:95:5)
    at next (/user_code/node_modules/express/lib/router/route.js:137:13)  errorInfo: 
   { code: 'auth/argument-error',
     message: 'Decoding Firebase ID token failed. Make sure you passed the entire string JWT which represents an ID token. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.' },
  codePrefix: 'auth' }

所以我检查了我是如何获得令牌的，它似乎没问题：

  public async getIdToken() {
    return this.angularFireAuth.auth.currentUser.getIdToken(true)
      .then(idToken => {
        return idToken
      })
      .catch(err => {
        throw new Error(err)
      })
  }

以及我如何验证它，似乎也很好（对我来说）

const validateFirebaseIdToken = (req, res, next) => {
  console.log('Check if request is authorized with Firebase ID token')

  if ((!req.headers.authorization || !req.headers.authorization.startsWith('Bearer ')) && !(req.cookies && req.cookies.__session)) {
    console.error('No Firebase ID token was passed as a Bearer token in the Authorization header.',
      'Make sure you authorize your request by providing the following HTTP header:',
      'Authorization: Bearer <Firebase ID Token>',
      'or by passing a "__session" cookie.')
    res.status(403).send('Unauthorized')
    return
  }

  let idToken
  if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
    console.log('Found "Authorization" header')
    idToken = req.headers.authorization.split('Bearer')[1]
  } else if(req.cookies) {
    console.log('Found "__session" cookie')
    idToken = req.cookies.__session
  } else {
    console.log('No cookie')
    res.status(403).send('Unauthorized')
    return
  }

  admin.auth().verifyIdToken(idToken)
    .then(decodedIdToken => {
      console.log('ID token correctly decoded', decodedIdToken)
      return next()
    })
    .catch(error => {
      console.error('Error while verifying Firebase ID token: ', error)
      res.status(403).send('Unauthorized')
    })

}

所以我记录了在getIdToken函数中返回的idToken和在admin.auth().verifyIdToken(idToken)被调用之前的idToken并且它们完全匹配。

所以我不明白为什么它会失败。

I already checked the documentation and it seems to match what I did https://firebase.google.com/docs/auth/admin/verify-id-tokens

Any ideas would be much appreciated.

Answer 1

卡洛斯来了

我认为这个过程很好，但是当你拆分标题时，令牌中可能会有一个额外的空间：

if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
    console.log('Found "Authorization" header')
    idToken = req.headers.authorization.split('Bearer')[1] // <- this part has a space at the beginning
}

修剪字符串可以帮助您解决问题吗？