解密/验证Firebase令牌

Question

I'm using Firebase with a Email & Password authentication. Once the user has been signed in successfully I'll receive an AuthData object which contains a token.
I wanna send this token to my backend, verify it and extract the uid from it - unfortunately I don't know how to do this.

I'm aware of the Firebase secret and if I go to jwt.io , enter the token and the secret the signature is verified and I see the correct payload - so this actually works.
Since I'm running Java on my backend I've been using jjwt for the decryption process unfortunately it always throws a SignatureException :

io.jsonwebtoken.SignatureException: JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.

Following the code I've been using:

SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
byte[] encodedKey = Base64.decode("my-firebase-secret", Base64.DEFAULT);
Key k = new SecretKeySpec(encodedKey, signatureAlgorithm.getJcaName());
Claims claims = Jwts.parser()
                    .setSigningKey(k)
                    .parseClaimsJws("the-token").getBody();

I've also tried it with the following snippet:

Claims claims = Jwts.parser()
                    .setSigningKey(DatatypeConverter.parseBase64Binary("my-firebase-secret"))
                    .parseClaimsJws(jwt).getBody();

But got the same exception. So what am I doing wrong? Thanks in advance.

Answer 1

Have you tried to use getBytes instead of parseBase64Binary? Here is the example:

Claims claims = Jwts.parser().setSigningKey("my-firebase-secret".getBytes("UTF-8")).parseClaimsJws(jwt).getBody();