0

I want to use firebase auth for my android and ios applications with custom backend. So I need some way of authentication for api calls from mobile apps to the backend.

I was able to find following guide in firebase documentation which suggests to sent firebase id token to my backend and validate it there with firebase Admin SDK. https://firebase.google.com/docs/auth/admin/verify-id-tokens

But this approach does not seem to be a security best practice. For example here https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/ it is said that for API access one should use access tokens rather than id tokens.

Are there any good pattern for using firebase auth with my backend?

2
  • 1
    The previous docs page discusses Custom Tokens, which may be used as access tokens, once you validate the ID token.
    – Ken Y-N
    Commented Jun 15, 2021 at 8:35
  • Thank you Ken Y-N, that seems to be a good solution
    – Ivan
    Commented Jun 15, 2021 at 8:39

1 Answer 1

2

firebaser here

Firebase itself passes the ID token with each request, and then uses that on the server to identify the user and to determine whether they're authorized to perform the operation. This is a common (I'd even say idiomatic) approach to authentication and authorization, and if there's a security risk that you've identified in it, we'd love to hear about it on https://www.google.com/about/appsecurity/

From reading the blog post it seems the author is making a distinction between authentication (the user proving their identify) and authorization (them getting access to certain resources based on that identity), but it'd probably be best to ask the author for more information on why that would preclude passing an ID token to identify the user.

3
  • 1
    I've come across several other resources that also say that id tokens should never be sent to a resource server oauth.net/id-tokens-vs-access-tokens Wondering if this answer is still accurate
    – Rojuinex
    Commented Sep 7, 2022 at 9:09
  • Yes, this is still accurate. The link you provide is equally unclear on why one should not pass an ID token as the link OP posted, so we can't comment on why that doesn't apply in the case that Firebase documents. Commented Sep 7, 2022 at 14:04
  • 1
    Thanks Frank. I think after I posted this I read somewhere that the article seemed to be from the perspective of symmetric keys, and possibly not thinking of short lived tokens. After thinking about it in the context of asymmetric keys there doesn't seem to be a difference between sending an auth_token and then making a HTTP request to the auth server to get the identity (which happens using PKI) and doing that exact same thing in a single shot with a signed JWT.
    – Rojuinex
    Commented Sep 8, 2022 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.