使用Firebase Admin SDK进行REST API身份验证

Question

I have a REST api and the authentication is done using jwt tokens. To make may api more secure (users and authentication mechanism) I would like to use firebase authentication. I would like to know can we use firebase as a authentication server for my REST APIs.

My understanding is that the client app will send the username and password to the firebase server and they will provide a token. Using that token client app will send an api call to our server. I need to integrate firebase admin SDK in my server and validate the token using admin SDK to get the data from my database.

Please correct me when I am wrong.

Also, i have a concern that how to manage refresh tokens to keep my app logged in.

Please help me to integrate this in the right way, and I am using nodejs/expressjs to create the APIs.

Answer 1

can we use firebase as a authentication server for my REST APIs.

Yes, it's one of the services they provide: https://firebase.google.com/products/auth/

My understanding is that the client app will send the username and password to the firebase server and they will provide a token.

Correct. The usual Firebase auth is done entirely client side.

But if there is a specific auth mechanism you need such as LDAP/AD or some other form of enterprise shenanigans, then you would need to create your own tokens that the client will use to authenticate: https://firebase.google.com/docs/auth/admin/create-custom-tokens

Using that token client app will send an api call to our server.

Correct. Once the client has successfully logged in and retrieved their ID tokens, you on the server side need to verify the ID token: https://firebase.google.com/docs/auth/admin/verify-id-tokens via middleware.

Also, i have a concern that how to manage refresh tokens to keep my app logged in.

You need not worry about that so long as the client uses the appropriate method to retrieve the ID token. For example, on the Web side the client would call: https://firebase.google.com/docs/reference/js/firebase.User#getIdToken which states (emphasis mine):

Returns the current token if it has not expired, otherwise this will refresh the token and return a new one .

As you can see, the client side Firebase SDK handles everything for you. There is no need for you on the server side to keep track of ID tokens, refresh tokens, or anything really. All you need to do is verify the token, that's it.

Please see my previous answer for more details on server side verification: Firebase authentication using NodeJS