How to decode Firebase JWT token in Python

Question

I added Firebase so that clients can authenticate directly from the client of the web application (browser). I am using firebase-web package and it works great. I see in my browser that I am getting a user object with user information, including idToken .

I need to then authenticate this user on my server, which is python django. In the Firebase docs, I found a practical guide for what I'm trying to do, namely check the id token .

Since they do not have a supported Firebase sdk for python, I need to use a third-party solution. I came in the python-jose package after I found it on jwt.io. An example looks simple enough:

 jwt.decode(token, 'secret', algorithms=['RS256']) 

This is my first time using JWT. I do not know what to use for 'secret' . I tried to insert my token as token and the web API key from the Firebase console for secret , but got this error:

jose.exceptions.JWKError: RSA key format not supported

I also tried the JWT debugger , which seems to read most of my id token correctly, but the signature check looks for public and / or private keys that, like 'secret' , elude me.

I really don't understand how to find this secret, and how to check the JWT identifier marker in general. Information about Firebase docs (third-party section):

Finally, make sure that the identifier token has been signed with the private key corresponding to the baby's requirement. Take the public key from https://www.googleapis.com/robot/v1/metadata/x509/ [e-mail] and use the JWT library to verify the signature. Use the max-age value in the Cache-Control header of the response from this endpoint to know when to update public keys.

I tried pasting all json blob from this googleapis URL into the JWT debugger, but I still get an "invalid signature" warning. I do not understand how to use this public key.

Should python-jose work for this approach? If so, what should I use for secrecy? If not, can someone point me in the right direction?

Thanks.

Answer 1

I finally found the answer I was looking for in this post: Migrating the Python firewall from Gitkit to Firebase-Auth using python-jose to check the token

Since publication, updates have been added to the python-jose package, which gives better support for firebase identifier tokens. Here is some working code ( jose version 1.3.1 ) on how to use python to decode the firebase id token:

 import urllib, json from jose import jwt idtoken = "<id token passed to server from firebase auth>" target_audience = "<firebase app id>" certificate_url = 'https://www.googleapis.com/robot/v1/metadata/x509/ [e-mail] ' response = urllib.urlopen(certificate_url) certs = response.read() certs = json.loads(certs) #will throw error if not valid user = jwt.decode(idtoken, certs, algorithms='RS256', audience=target_audience) print user