CODEWITHSUNDEEP
node.jsfirebasesecuritygoogle-cloud-functionssecret-key
Chadd
Chadd

Reputation: 636

Storing the googleapi Secret Keys in Firebase Environmental Variables

Question

I would like to store a Secret API Key for googleapis in a secure location. When I store the Secret API Key from googleapis as a Firebase Environmental Variable, the private_key is not processed the same as when I require("./privatekey.json"); See Issue below:

Context

I have downloaded and decoded a Secret API Key from Google. Most examples show saving the decoded JSON file within your project path and using require to pull the token into to code.

const SERVICE_ACCOUNT_KEY_FILE = require("./privatekey.json");  <----- This is Bad!!


const SERVICE_ACCOUNT_EMAIL = '[email protected]';
const jwt = new googleapis.auth.JWT(
        SERVICE_ACCOUNT_EMAIL,
        SERVICE_ACCOUNT_KEY_FILE.private_key,
        null,
        ['https://www.googleapis.com/auth/analytics.readonly']);

I have used the firebase-cli to firebase functions:config:set Firebase Environmental Variables. When complete and redeployed, I run firebase functions:config:get and I see:

 "googleapi_credentials": {
    "private_key": "-----BEGIN PRIVATE KEY-----\\nMIIE  ... q0DEg==\\n-----END PRIVATE KEY-----\\n",

Issue

When I configure googleapis.auth.JWT() I need to provide the googleapis Secret API Key. When I use require to pull in the Secret API Key, the requests work.

However, if I try to access the Firebase Environmental Variable to provide the Secret API Key, the requests fail.

var jwt = new googleapis.auth.JWT(
        functions.config().googleapi_credentials.client_email,
        functions.config().googleapi_credentials.private_key, <----- NOPE!
        null,
        ['https://www.googleapis.com/auth/analytics.readonly']);

Debug

To see what's different I compared the console.log() of the two tokens in the firebase functions log view. The token I stored in the JSON file and in Firebase Environmental Variables looks the same in code, that is, both strings match and they include many \n (line breaks).

Now, when I review what the console.log() returns in the Firebase Functions Logs, I see different tokens.

console.log("JSON Private.Key", privatekey.private_key)

The view in the logs returns a formatted string with all \n replaced by line breaks, and the token is accepted.

console.log("Private.Key", functions.config().googleapi_credentials.private_key)

Logs returns a sting will all \n replaced by \\n., and the token is not accepted.

Final Note

The googleapis.auth.JWT() function can take an object for it arguments? Do I need to take this into consideration if using Firebase Environmental Variables?

Upvotes: 1

Views: 2236

Answers (2)

Chadd
Chadd

Reputation: 636

Here is a hack I found posted by YunjorGlez. This worked for me.

You can use .replace(/\n/g, '\n') to remove the extra \ that is being added to the private_key.

const serviceAccount = functions.config().fireenv;

admin.initializeApp({
   credential: admin.credential.cert({
      "projectId": serviceAccount.project_id,
      "private_key": serviceAccount.private_key.replace(/\\n/g, '\n'),
      "clientEmail": serviceAccount.client_email
   }),
   databaseURL: whatever,
   ...
});

Upvotes: 0

sketchthat
sketchthat

Reputation: 2688

Firebase environment details have a problem with add slashes and can break \n strings.

There is an open ticket on GitHub which should be referred to; github.com/firebase/firebase-tools/issues/371

Upvotes: 2

Related Questions