CODEWITHSUNDEEP
firebasejwtkeytokenkeystore
Evgeni Atanasov
Evgeni Atanasov

Reputation: 520

Firebase's idTokens unknown kid

I am making a NodeJS application using Firebase for authentication. My goal is to verify/validate the issued JWT idTokens.

I got to the point where I do have idTokens returned on:

  1. Sign Up REST Endpoint
  2. Sign In Rest Endpoint

I also have the official endpoint returning public certificates, as well as the undocumented one returning the JWKs:

Verifying the token from 1) "Sign Up REST Endpoint" against the public keys and jwks is good. Verifying the token from 2) "Sign In REST Endpoint" gave error for missing key.

  1. is returning "kid": "dc37d59365c6228b8ccdaca5360ac24d0415c1ea"
  2. is returning "kid": "tB0M2A".

"kid": "tB0M2A" is not being returned either in the public keys nor in the jwks endpoints.

Has anyone faced similar issues and does anyone have knowledge where the public keys for validating the sign in idToken are coming from?

Upvotes: 0

Views: 225

Answers (1)

Evgeni Atanasov
Evgeni Atanasov

Reputation: 520

It turned out that there is additional body parameter returnSecureToken that should be passed in the request.

Now the Firebase API returns tokens with valid IDs that can be verified by third-party JWT libraries.

Upvotes: 0

Related Questions