如何将服务器认证到Firebase？ [英] How do you authenticate a server to Firebase?

问题描述

我有一个在Firebase上编写的应用程序。安全规则和客户端代码不足以使我的应用程序工作。我需要连接一个服务器来执行一些任务：

• 清理使用
  onDisconnect
  处理程序


• 建立我的数据额外的索引超出我可以做
  
  

• ：如果您在 https://firebase.google.com 上创建了项目，则这些步骤将从服务器是不同的。看到这个答案： Firebase 3中是否可以对令牌进行服务器端验证？
  
  
  

  有两种方法可以执行此操作：生成服务器身份验证令牌或使用Firebase秘密。
  
  

  生成服务器令牌
  您可以使用相同的令牌生成器库为自定义登录创建，以生成可从服务器使用的令牌。然后，您可以从安全规则中提供对此服务器的特殊访问权限。

  
  
  

  以下是步骤：
  
  

  
  
  1. 获取令牌生成器库用于您的服务器的语言/平台。 Node.js和Java服务器往往效果最好。
     使用预先选择的uid生成一个标记。如果您正在编写node.js服务器，代码可能如下所示：

       var FirebaseTokenGenerator = require（firebase -token发电机）; 
      var tokenGenerator = new FirebaseTokenGenerator（< your-firebase-secret>）; 
      var token = tokenGenerator.createToken（
      {uid：my-awesome-server}，
      {expires：< far_into_the_future_seconds>}）; 
       

  
  

  2. 使用令牌验证您的客户端。以下是更多的node.js代码：
     
     

       var ref = new Firebase（https：//< your-firebase> .firebaseio的.com /）; 
      ref.authWithCustomToken（token，function（error，authData）{
      ... 
     }）; 
       

  
  

  3. 如果服务器的语言没有客户端， PHP，使用您的REST请求的标记作为 auth 参数。

  更新您的安全规则以授予您特殊的权限服务器，由uid标识，就像这个简单的规则，允许读取访问整个Firebase

    {
  规则：{
  .write：false，
  .read：auth.uid ==='my-awesome-server'
  } 
  } 
    

  
  

  4. 访问所有的数据，做很棒的事情。 $ b

  优势
  
  

  
  
  • 正式推荐的方式来验证您的服务器。
  
  
  • 您的服务器将尊重验证规则。
  
  
  • 服务器只是另一个用户。您可以使用安全规则来提供对数据的细粒度访问。
  
  
  • 由于访问是精细的，因此服务器中的错误不太可能造成损害，例如删除根节点。 li>
    
  
  
  

  Firebase秘密
  
  

  喜欢生活在边缘的开发者，以及类型 sudo ，然后直接使用Firebase秘密进行身份验证。
  
  

  但严重的是，不要这样做。这是危险的。
  
  

  不做的原因
  
  

  
  
  • 就像盲目地使用 sudo 一样，这是非常危险的。
    你的
    服务器不会遵守你的验证规则。
  
  
  • 您的服务器已完全读取您的Firebase的
    /写入权限。如果它有一个丑陋的bug，它
    可能会删除或损坏没有业务访问的数据。
  
  
  • 您的
    秘密在更多地方（可能在出站请求日志，
    等）中结束。如果您冒险，您将面临更大的风险。
  
  
  
  

  I have an app written on Firebase. Security rules and client side code aren't quite enough to make my app work. I need to connect a server to do a few tasks:

  • Cleaning up denormalized data that's challenging to clean up using onDisconnect handlers
  • Building additional indexes of my data that go beyond what I can do with queries

  解决方案

  Updated (20160611): if you created your project on https://firebase.google.com, the steps access the database from a server are different. See this answer: Is it still possible to do server side verification of tokens in Firebase 3?

  There are two ways that you can do this: Generate a server auth token, or use a Firebase secret.

  Generate a server token You can use the same token generator libraries created for Custom Login to generate tokens that you can use from your server. You can then provide special access to this server from your security rules.

  Here are the steps:

  1. Get the token generator library for your server's language / platform. Node.js and Java servers tend to work best.

  2. Generate a token with a pre-selected uid. If you're writing a node.js server, the code might look something like this:

     var FirebaseTokenGenerator = require("firebase-token-generator");
     var tokenGenerator = new FirebaseTokenGenerator("<your-firebase-secret>");
     var token = tokenGenerator.createToken(
        {uid: "my-awesome-server"}, 
        { expires: <far_into_the_future_seconds> });
     

  3. Use the token to authenticate your client. Here's more node.js code:

     var ref = new Firebase("https://<your-firebase>.firebaseio.com/");
     ref.authWithCustomToken(token, function(error, authData) {
       ...
     });
     

  4. If there's no client for your server's language, e.g. PHP, use the token for your REST requests as the auth parameter.

  5. Update your security rules to grant special permissions your server, as identified by the uid, like this simple rule that allows read access to the whole Firebase

     {
         "rules": {
             ".write": false,
             ".read": "auth.uid === 'my-awesome-server'"
         }
     }
     

  6. Access all the data, do awesome stuff.

  Advantages

  • This is Firebase's officially recommended way to authenticate your server.
  • Your server will respect validation rules.
  • The server is just another user. You can use security rules to provide fine grained access to your data.
  • Since access is fine grained, it's unlikely a bug in your server will cause damage, like delete your root node.

  Firebase secret

  If you're the kind of developer who enjoys living on the edge, and types sudo at the drop of a hat, you can also authenticate using your Firebase secret directly.

  But seriously, don't do this. It's dangerous.

  Reasons not to do it

  • Just like blindly using sudo, it's incredibly dangerous.
  • Your server will not respect your validation rules.
  • Your server full read / write access to your Firebase. If it has an ugly enough bug, it might delete or corrupt data that is has no business accessing.
  • Your secret ends up in more places (potentially in outbound request logs, etc). You are exposed to more risk if it gets out.

  这篇关于如何将服务器认证到Firebase？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！