如何向 Firebase 验证服务器? [英] How do you authenticate a server to Firebase?
问题描述
我有一个用 Firebase 编写的应用.安全规则和客户端代码不足以使我的应用程序正常工作.我需要连接服务器来完成一些任务:
I have an app written on Firebase. Security rules and client side code aren't quite enough to make my app work. I need to connect a server to do a few tasks:
- 使用以下方法清理难以清理的非规范化数据onDisconnect处理程序
- 为我的数据建立超出我所能做的额外索引和查询
推荐答案
更新 (20160611):如果您在 https://firebase.google.com，从服务器访问数据库的步骤是不同的.请参阅此答案:是否仍然可以在 Firebase 3 中对令牌进行服务器端验证?
Updated (20160611): if you created your project on https://firebase.google.com, the steps access the database from a server are different. See this answer: Is it still possible to do server side verification of tokens in Firebase 3?
您可以通过两种方式执行此操作:生成服务器身份验证令牌，或使用 Firebase 密钥.
There are two ways that you can do this: Generate a server auth token, or use a Firebase secret.
生成服务器令牌您可以使用为自定义登录创建的相同令牌生成器库生成可以从服务器使用的令牌.然后，您可以根据您的安全规则提供对该服务器的特殊访问.
Generate a server token You can use the same token generator libraries created for Custom Login to generate tokens that you can use from your server. You can then provide special access to this server from your security rules.
步骤如下:
- 获取令牌生成器库 适用于您的服务器语言/平台.Node.js 和 Java 服务器往往效果最好.
使用预先选择的 uid 生成令牌.如果您正在编写 node.js 服务器，则代码可能如下所示:
- Get the token generator library for your server's language / platform. Node.js and Java servers tend to work best.
Generate a token with a pre-selected uid. If you're writing a node.js server, the code might look something like this:
var FirebaseTokenGenerator = require("firebase-token-generator");
var tokenGenerator = new FirebaseTokenGenerator("<your-firebase-secret>");
var token = tokenGenerator.createToken(
{uid: "my-awesome-server"},
{ expires: <far_into_the_future_seconds> });
使用令牌来验证您的客户端.这里有更多的 node.js 代码:
Use the token to authenticate your client. Here's more node.js code:
var ref = new Firebase("https://<your-firebase>.firebaseio.com/");
ref.authWithCustomToken(token, function(error, authData) {
...
});
如果您的服务器语言没有客户端，例如PHP，将令牌用于您的 REST 请求作为 auth 参数.
更新您的安全规则以授予您的服务器的特殊权限，如 uid 所标识的，就像这个允许对整个 Firebase 进行读取访问的简单规则
Update your security rules to grant special permissions your server, as identified by the uid, like this simple rule that allows read access to the whole Firebase
{
"rules": {
".write": false,
".read": "auth.uid === 'my-awesome-server'"
}
}
访问所有数据，做一些很棒的事情.
Access all the data, do awesome stuff.
优势
- 这是 Firebase 官方推荐的对您的服务器进行身份验证的方法.
- 您的服务器将遵守验证规则.
- 服务器只是另一个用户.您可以使用安全规则来提供对数据的细粒度访问.
- 由于访问是细粒度的，因此服务器中的错误不太可能造成损坏，例如删除根节点.
Firebase 机密
如果您是那种喜欢生活在边缘的开发者，并且输入 sudo 顺便说一句，您还可以直接使用您的 Firebase 密钥进行身份验证.
If you're the kind of developer who enjoys living on the edge, and types sudo at the drop of a hat, you can also authenticate using your Firebase secret directly.
但是说真的，不要这样做.很危险.
But seriously, don't do this. It's dangerous.
不这样做的原因
- 就像盲目使用
sudo一样，这是极其危险的. - 你的服务器不会尊重您的验证规则.
- 您的服务器已完全读取/对 Firebase 的写访问权限.如果它有一个足够丑陋的错误，它可能会删除或损坏无业务访问的数据.
- 你的秘密最终出现在更多地方(可能在出站请求日志中，等等).如果泄露出去，您将面临更大的风险.
- Just like blindly using
sudo, it's incredibly dangerous. - Your server will not respect your validation rules.
- Your server full read / write access to your Firebase. If it has an ugly enough bug, it might delete or corrupt data that is has no business accessing.
- Your secret ends up in more places (potentially in outbound request logs, etc). You are exposed to more risk if it gets out.
这篇关于如何向 Firebase 验证服务器?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
