如何使用 Firebase 令牌验证保护我的 Google Cloud Endpoints API? [英] How do I secure my Google Cloud Endpoints APIs with Firebase token verification?

问题描述

我的设置:

• 在 Google App Engine 上托管的 Java 后端，其中包含使用 Google Cloud Endpoints 创建的 API
• 包含为上述端点生成的客户端库的移动客户端应用程序.还与 Firebase 集成以进行身份​​验证和数据库.

我的意图是移动客户端应用程序的用户将能够使用 Firebase 身份验证登录移动应用程序，然后连接到任何后端 API，后者将进行一些处理，然后读取或写入数据到/从 Firebase 数据库.

My intention is that a user of the mobile client applications will be able to log in to the mobile app using Firebase authentication, then connect to any of the backend APIs, which in turn will do some processing and then read or write data to/from the Firebase database.

为了保护服务器上的 API，我想我必须使用 Firebase Server SDK 的内置 verifyIdToken() 方法(参见 在 Firebase 上验证 ID 令牌)以解码从客户端应用程序传递的用户 ID 令牌.由于 verifyIdToken() 异步运行，我如何将它与 GAE 中的 API 方法集成?到目前为止，我有类似以下内容:

To secure the APIs on the server, I think I'll have to use the built-in verifyIdToken() method of the Firebase Server SDK to (see Verifying ID Tokens on Firebase) to decode a user's ID token passed from the client application. As verifyIdToken() runs asynchronously, how would I integrate it with an API method in GAE? I have something similar to the following so far:

@ApiMethod(name = "processAndSaveToDB", httpMethod = "post")
    public Response processAndSaveToDB(@Named("token") String token) {

        Response response = new Response();           

        // Check if the user is authenticated first
        FirebaseAuth.getInstance().verifyIdToken(idToken)
            .addOnSuccessListener(new OnSuccessListener() {
                @Override
                public void onSuccess(FirebaseToken decodedToken) {
                    String uid = decodedToken.getUid();

                    // do bulk of processAndSaveToDB() method

                })
            .addOnFailureListener(new OnFailureListener() {
                @Override
                public void onFailure(Exception e) {

                    // throw unauthorized exception

            });

    return response;
}

推荐答案

由于此身份验证任务在任务队列中异步运行，您可以等待该任务结束并以同步方式继续，您可以选择添加侦听器 onSuccess、onFailure并完成.

As this authentication task is running asynchronously in task queue, you can wait until that task is ended and continue in synchronous way, optionally you can add listeners onSuccess, onFailure and onComplete.

Task<FirebaseToken> authTask = FirebaseAuth.getInstance().verifyIdToken(idToken)
.addOnSuccessListener(new OnSuccessListener() {
        @Override
        public void onSuccess(Object tr) {//do smtg }
    }).addOnFailureListener(new OnFailureListener() {
        @Override
        public void onFailure(Exception excptn) {//do smtg }
    }).addOnCompleteListener(new OnCompleteListener() {
        @Override
        public void onComplete(Task task) {//do smtg }
    });
    try {
        Tasks.await(authTask);
    } catch(ExecutionException | InterruptedException e ){
        //handle error
    }
    FirebaseToken decodedToken = authTask.getResult();

这篇关于如何使用 Firebase 令牌验证保护我的 Google Cloud Endpoints API?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！