Firebase：如果我使用服务器端 session cookies，如何在客户端获取登录用户的 ID 令牌？

Question

I am using Firebase Cloud Functions with Express and Firebase Hosting to serve my multi-page site. I have successfully implemented server-side cookies as explained here and as implemented below:

function verifyLogin(request, response, next) {
    const sessionCookie = request.cookies.__session || '';
    firebase.auth().verifySessionCookie(sessionCookie, true /** checkRevoked */ )
        .then((decodedClaims) => {
            //serve content for user
            return next();
        }).catch(error => {
            // Session cookie is unavailable or invalid. Force user to log in.
            console.log(error);
            response.redirect('/login');
            return;
        });
}

app.get('/', verifyLogin, (request, response) => {
    var page_title = "Home";
    response.render('index', {
        page_title,
    });
});

I am using the Firebase Web SDK (JavaScript) to access the Firebase Cloud Firestore. In order to do this, I need to get the idToken on the client side for the currently-logged-in user, like so:

firebase.auth().onAuthStateChanged(firebaseUser => {
    if (firebaseUser) {
        firebase.auth().currentUser.getIdTokenResult()
            .then((idTokenResult) => {
                 // Access the Firebase Cloud Firestore here
            });
    }
});

This seems redundant to me, since I already know which user is signed in via my server cookie, but how else can I get the idToken without another call to Firebase Auth?

Is there a way to extrapolate it from my session cookie somehow and pass it to my client from my cloud function as a variable?

Or is there another way to look at this philosophically that I am overlooking?

Answer 1

In the same way you can listen to user sign-in state changes using onAuthStateChanged() , you can also listen to user ID token changes using onIdTokenChanged() . You will only need to use a new token when the observer you attach shows that a new one appears (for example, when it's refreshed every hour by the SDK).