How to verify JWT from Firebase?

[ben519]

Firstly, thanks for your work on this package!

I'm trying to verify a session cookie from Google Firebase following the directions here, guided by this sample implementation in Python.

From the docs, verification should use algorithm "RS256" and a kid corresponding to one of the IDs from https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com

At present time, that URL resolves to a JSON object like this

{
  "d1689415ec23a337e2bbaa5e3e68b66dc9936884": "-----BEGIN CERTIFICATE-----\nMIIDHTCCAgWgAwIBAgIJALUunHvokterMA0GCSqGSIb3DQEBBQUAMDExLzAtBgNV\nBAMMJnNlY3VyZXRva2VuLnN5c3RlbS5nc2VydmljZWFjY291bnQuY29tMB4XDTI0\nMDEwMTA3MzIwNloXDTI0MDExNzE5NDcwNlowMTEvMC0GA1UEAwwmc2VjdXJldG9r\nZW4uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQCiJ4CCXrGGh0pfH60RxPyl6qSCn4fBFH7YZ5CMaMTYFKvg\n7MAIaOygQaSc0iDkigVF+6qmDqgkvm+HJFnPFHaVOeB20DLpzRXW50S4AhBU0HUs\npAu+NRAjBoqeODyBiNBjiaoqmHoltSuVVaE3qrKTdHaApfZ0OGw62txx7hzzoYQO\n0J2/BoZVkjoKyU0f5tUxVMlUN1UwACXjPd6VSiM1iYBaZ5UannvjmwzNp7eXYnm0\nylVLdypN3HYYlKjjLFIWmCLGItfoVE67/4Cm/H8b2aP3HJgCCc7qQN2+VA1aasl9\n9l5WgzcwvNYhVWfz3eqUgqy+bSDmpmzHofAvwBsVAgMBAAGjODA2MAwGA1UdEwEB\n/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMCMA0G\nCSqGSIb3DQEBBQUAA4IBAQCLcknZv527sAryfBnemO14+wsNQg5oWCE3WLcS5KQZ\noJpfXG83YGNbfbJqgQX8BG+e2mRp0K3XqpHFbyqkfyhJm4mM5xzzGuVS71DO3Jb7\np2m9pabSPodhmCT8FPXNb4Ms4oqlaDJ5gzXVij6CYE6GA+FystELNXVtoNM5WfI9\nhJVvm5UA07Kw42rp+apTrSTfni2jMpHq/gKiXxJHB/M98pPf3kgXzr4dKN0Xdra2\nrCywvsYnSmBfDBfSuXFpITW+q+3UqtLWq6v01coXxfG7+s/fEeGhpVaby/4YVvCv\nZamW2WUiDUktVUbnIKTjJiqCo5kOBlguX1yyJmJSd/1t\n-----END CERTIFICATE-----\n",
  "7cf7f8727091e4c77aa995db60743b7dd2bb70b5": "-----BEGIN CERTIFICATE-----\nMIIDHTCCAgWgAwIBAgIJAIqVi9h5GUZ3MA0GCSqGSIb3DQEBBQUAMDExLzAtBgNV\nBAMMJnNlY3VyZXRva2VuLnN5c3RlbS5nc2VydmljZWFjY291bnQuY29tMB4XDTI0\nMDEwOTA3MzIwN1oXDTI0MDEyNTE5NDcwN1owMTEvMC0GA1UEAwwmc2VjdXJldG9r\nZW4uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQCUcjjtp36jO9jN05a9GU/o5cw1P5JSzO+TFA5zmVONZoHw\nCrYBWy0I2b01w646ynT1dZsDpwfYN9/gOFrEkEUj2Hc03UUuO0LV5cxdOe1Ze7cX\n4iX/+ycvAKb4W8+ZK+uaiMYhoDwo8U+hF27U8jBjcDGvLRvT1PatZzppaOW/zeVt\nSCmc3lYzyb81Pf0J8bH53pzP4iCljPCnh59NgumfU0tOZzVxHq94vkUMG1HHFLNO\n/JnPSOfbQCJfdW1097xM/5BLYOtXqyHhnXHEJREKnhve59rg51q1wcXzHtZDXrQh\n1AR5OZsjsZW8j23FxDn2aPmPxkH4qZTl259hkhjZAgMBAAGjODA2MAwGA1UdEwEB\n/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMCMA0G\nCSqGSIb3DQEBBQUAA4IBAQCLOdTu4aDNs5cgncpoh7PHtPoIdn+tn27CwEujPM+u\nnIpnQ92PeHXbXxsl7J/rzXGzyq7RhB0UqtZMT3FgKD80sr0pDI+WtwgGV4QyVcXv\nCXKbaOMJMmlUVFy0kVGjoi4XJoFqt1UXw5nfV+PxWNpYLukRetRvbhztpM5ZgVg1\n99tdKDcCmRSvgGcI3ejEWdtsTEbn4BaXRvxSNU9/Nf82dcCXNBgLgBXWEkioYidT\n2nGIR2m2EAlGnTxqMUh7I/ZrLWg9hXJHTQPRUJDL59kOxCgBUmVkmUfA+m5mv5t0\nBC8UojdMn77yvpsWhmULueSOY3BI+CqZPmJkq+En0ptc\n-----END CERTIFICATE-----\n"
}

My attempt

(Forgive my ignorance - a lot of this is over my head, but I have read the docs and other discussions..)

I've tried using createRemoteJWKSet to no avail.

const JWKS = jose.createRemoteJWKSet(
    new URL(
      "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
    )
  )

const mytest = await JWKS()

The error message I get is

Error: JSON Web Key Set malformed

Further notes

1. This shouldn't affect the issue at hand, but I did notice that my token is missing kid in development mode, but it does contain kid in production. Hopefully that's okay.

2. Once I get JWKS working, my plan was to make a subsequent call to verify the token like this

   const { payload, protectedHeader } = await jose.jwtVerify(
       sessionCookie.value,
       JWKS,
       {
         issuer,
         audience,
       }
     )
     console.log("protectedHeader", protectedHeader)
     console.log("payload", payload)
   

3. Here's a sample token that I'm working with in development mode (note that it's missing kid)

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYW1lIjoiTXlzdGVyaW91cyBVc2VyIiwic3RyaXBlIjp7ImNvbm5lY3QiOnsiaWQiOiJhY2N0XzFPWUFDMDRJS2Y2dklNSEIiLCJwYXlvdXRzX2VuYWJsZWQiOmZhbHNlLCJmZWVfcGN0IjowLjEsImZlZV9hbXQiOjAuM30sImN1c3RvbWVyIjp7ImlkIjoiY3VzX1BNdTBLejdKVmJJcUhsIiwic3Vic2NyaXB0aW9ucyI6e30sInB1cmNoYXNlcyI6W119fSwicXVvdGFzIjp7Im1heF9wcm9kdWN0cyI6MTAwLCJtYXhfcG9zdHMiOjMwMCwibWF4X2RlcHRoIjo2LCJtYXhfZmlsZXMiOjEwMDAsIm1heF9maWxlX2J5dGVzIjo1MDAwMDAwLCJzdG9yYWdlX2J5dGVzIjoxMDAwMDAwMDB9LCJyb2xlIjoidXNlciIsImVtYWlsIjoiZm9vQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiYXV0aF90aW1lIjoxNzA1MTYzNzc5LCJ1c2VyX2lkIjoiVTEzVEgzYWZMMnpicGNQZ1hVbGdXc3BrTFREciIsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsiZm9vQGdtYWlsLmNvbSJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn0sImlhdCI6MTcwNTE2Mzc4NCwiZXhwIjoxNzA1NTk1Nzg0LCJhdWQiOiJzY2lwcmVzcy1kZXYiLCJpc3MiOiJodHRwczovL3Nlc3Npb24uZmlyZWJhc2UuZ29vZ2xlLmNvbS9zY2lwcmVzcy1kZXYiLCJzdWIiOiJVMTNUSDNhZkwyemJwY1BnWFVsZ1dzcGtMVERyIn0.

Any guidance here would be great, thanks!

[panva]

// CACHE THIS FOR SUBSEQUENT REQUESTS
const JWKS = jose.createRemoteJWKSet(new URL('https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com'))

const { payload, protectedHeader: header } = await jose.jwtVerify(
    jwt,
    JWKS,
    {
      issuer,
      audience,
    }
  )

console.log({ payload, header })

As for your development tokens, they're Unsecured JWT so you need to use jose.UnsecuredJWT.decode. Just be sure to only use UnsecuredJWT in development environments.

const { payload, header } = jose.UnsecuredJWT.decode(jwt) // ONLY IN DEVELOPMENT ENVIRONMENTS
console.log({ payload, header })

[ben519]

Sure thing.

eyJhbGciOiJSUzI1NiIsImtpZCI6ImxrMDJBdyJ9.eyJpc3MiOiJodHRwczovL3Nlc3Npb24uZmlyZWJhc2UuZ29vZ2xlLmNvbS9zY2lwcmVzcy1kZXYiLCJuYW1lIjoiTXlzdGVyaW91cyBVc2VyIiwic3RyaXBlIjp7ImNvbm5lY3QiOnsiaWQiOiJhY2N0XzFPWUNselFNUE9PZG5WWHYiLCJwYXlvdXRzX2VuYWJsZWQiOmZhbHNlLCJmZWVfcGN0IjowLjEsImZlZV9hbXQiOjAuM30sImN1c3RvbWVyIjp7ImlkIjoiY3VzX1BNd2ZUN0tLRUxyTnBNIiwic3Vic2NyaXB0aW9ucyI6e30sInB1cmNoYXNlcyI6W119fSwicXVvdGFzIjp7Im1heF9wcm9kdWN0cyI6MTAwLCJtYXhfcG9zdHMiOjMwMCwibWF4X2RlcHRoIjo2LCJtYXhfZmlsZXMiOjEwMDAsIm1heF9maWxlX2J5dGVzIjo1MDAwMDAwLCJzdG9yYWdlX2J5dGVzIjoxMDAwMDAwMDB9LCJyb2xlIjoidXNlciIsImF1ZCI6InNjaXByZXNzLWRldiIsImF1dGhfdGltZSI6MTcwNTE3MzY5MywidXNlcl9pZCI6ImFaUjBobHVZZzllSnZ1THIwTVV6c0poWFY2QjMiLCJzdWIiOiJhWlIwaGx1WWc5ZUp2dUxyME1VenNKaFhWNkIzIiwiaWF0IjoxNzA1MTczNzAyLCJleHAiOjE3MDU2MDU3MDIsImVtYWlsIjoiYmdvcm1hbjUxOSsyQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiZmlyZWJhc2UiOnsiaWRlbnRpdGllcyI6eyJlbWFpbCI6WyJiZ29ybWFuNTE5KzJAZ21haWwuY29tIl19LCJzaWduX2luX3Byb3ZpZGVyIjoicGFzc3dvcmQifX0.llZ_sb795NubLNMDJt-Dw7xSWVcOPLwCVKu1Wwy2qy9HZQEko00dVNa34HLs1W_u5IkDjzpIgvDtN0YRkzAX62cif3peVvOkdjPqddtRY6KuFHeVhEDFtj_xep03oheL7hk4IP0xu66YQxCrFo9Ig-z5e05A6ARGGCYX7sOIzvCietHbp9xkbImkO-4PcTGCN5AahGlNHy6JAOHnrVs1AQ0BIfundGBMLjpJNFtQ5G2OcGu855XCHKwYwLlN268Nqn7xDdCy38Ogm18gmUn-2fEqYeAJcgPdM-_fKAhb3IrJUDtvOEEXhdJgO1N--YweeBB7u6GtarDoxfSOJffiuQ

[ben519]

If it's helpful, Firebase's logic for token verification appears to be here. Note that I have used their verifySessionCookie() function successfully - it's just slow.

[ben519]

UPDATE: I think I found the issue. Firebase docs give the wrong URL, as indicated here

// URL containing the public keys for the Google certs (whose private keys are used to sign Firebase
// Auth ID tokens)
const CLIENT_CERT_URL = 'https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com';

// URL containing the public keys for Firebase session cookies. This will be updated to a different URL soon.
const SESSION_COOKIE_CERT_URL = 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys';

I can see my kid in second URL (https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys)

[panva]

It would appear you're mixing up firebase's Session Tokens with ID Tokens from ??their other interfaces. These are not the same. The above works for ID Tokens, the below works for their Session Tokens.

The session token's issuer keys are not to be found in a JWKS format but only in their weird format here.

To verify their Session Tokens you need to work with this weird format yourself, createRemoteJWKSet cannot do this for you because it's not a JSON Web Key Set, a rudimentary version would look like so:

import * as jose from "jose";

let publicKeys;
async function sessionPublicKeyResolver(protectedHeader) {
  const { kid, alg } = protectedHeader;
  if (!publicKeys || !(kid in publicKeys)) {
    publicKeys = await fetch(
      "https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys"
    ).then((r) => r.json());
  }

  // key object was not cached yet
  if (typeof publicKeys[kid] === "string") {
    publicKeys[kid] = await jose.importX509(publicKeys[kid], alg);
  }

  return publicKeys[kid];
}

const { payload, protectedHeader: header } = await jose.jwtVerify(
  sessionToken,
  sessionPublicKeyResolver,
  {
    issuer,
    audience,
  }
);

console.log({ payload, header });

[ben519]

This worked! I cannot thank you enough!