如何使用 Javascript 在 Firestore 中验证用户的 ID 令牌？

Question

I am building a react native application and am using Firebase, more specifically firestore, in order to manage my data. My current objective is to implement an auto login feature on my app, where if the user exits the app, I want them to stay signed in, unless they manually hit the Sign Out button before exiting the app. Here is my current process of doing this:

When the user logs into the app, I sign them in by: firebase.auth().signInWithEmailAndPassword(email, password) . I then get their idToken by:

  let authIdToken = "";
  firebase
    .auth()
    .currentUser.getIdToken(true)
    .then(function (idToken) {
      authIdToken = idToken
    })
    .catch(function (error) {
      console.log(error)
    });

I then want to save this token into the phone, so when the user opens the app again, I can fetch this token and check its validity. If it is valid, then I can log the user in using their idToken. In react native, I can do this by doing:

AsyncStorage.setItem(
    "userData",
    JSON.stringify({
      token: token,
    })
  );

Now when the app loads up:

const startScreen = props => {
   useEffect(() => {
    const tryLogin = async () => {
     const userData = await AsyncStorage.getItem("userData");
     const transformedData = JSON.parse(userData);
     const { token } = transformedData;

     await firebase
       .auth()
       .verifyIdToken(token, true)
       .then((payload) => {
         console.log(true)
       })
       .catch((error) => {
         if (error.code == "auth/id-token-revoked") {
           // Token has been revoked. Inform the user to reauthenticate or signOut() the user.
           console.log("revoked")
         } else {
           console.log("error")
         }
       });
    };
    tryLogin();
 }, []);

The Issue: When I try to verify the token this way, I am met with the following error: firebase.auth().verifyIdToken is not a function. I read through the documentation and am unsure of how else to verify this token using JS. How do I verify it? Let me know if my verification process is incorrect and how it should be done. I am new to using firestore and doing authentication in general and hope to learn how to do it the right way.

Another helpful note: This is how I am configuring my firestore: .firebase.apps?length. firebase:initializeApp(firebaseConfig); {}; .firebase.apps?length. firebase:initializeApp(firebaseConfig); {};

Thanks!

Answer 1

I then want to save this token into the phone, so when the user opens the app again, I can fetch this token and check its validity.

This is completely unnecessary. Firebase Auth with persist the signed in user, and automatically refresh the token without you having to do anything. All you need to do is listen to when updates to the token are made available, and act on the new token as needed. You can establish an ID token listener using onIdTokenChanged as shown in the linked API documentation:

firebase.auth().onIdTokenChanged(function(user) {
  if (user) {
    // User is signed in or token was refreshed.
  }
});

Once you have this token, you know that the user is successfully signed in. There is nothing left to do. There is no need to use it to sign in.

Also, you can't verify the token on the frontend. The verifyIdToken method you're looking at is for the Admin SDK only, which only runs on the backend. The idea is that you get the token on the fronend, then pass it to the backend as described in the documentation for the Admin SDK . The backend uses this to securely determine if the user on the frontend is who they say they are.

Since you didn't say if you have a backend or not, dealing with this token might not be necessary at all. If you just want to know when the user is signed in (even if they are just returning to the page after being away, then you can skip everything above and just use an auth state observer . Again, Firebase Auth persists information about the user so you don't have to sign them in again. The observer will tell you when the automatic sign-in is complete, or if they are not signed in at all.