Firebase 身份验证 - REST API NodeJS

Question

What's the difference between using admin.auth().verifyIdToken() and admin.auth().createSessionCookie() + admin.auth().verifySessionCookie() for authentication purposes and which one should I use in my Express REST API?

Also, doesn't the verifyIdToken already create a session itself that can be refreshed everytime it is called? And does verifying the session cookie do the same?

Answer 1

You create the session to get a token on the client device and use the verify token on the server/cloud.

I get the token from the current user then send it to firebase cloud functions endpoint to verify it.

Endpoint

import * as admin from 'firebase-admin'

const DEPLOYED = false;

admin.initializeApp()

const ValidateToken = (request: any, response: any) => {

    const params = {
        a: request.body.token, // Client Validation
    }

    const ValidateToken = admin.auth().verifyIdToken(params.a).catch((error) => { throw { Message:error }});

    return Promise.all([ValidateToken]).then((res: any) => {
        return DEPLOYED ? res : response.status(200).json(res);
    }).catch(error => {
        return DEPLOYED ? error : response.status(400).json(error);
    });
}

export default ValidateToken;