Question

我正在遵循此https://firebase.google.com/docs/auth/admin/verify-id-tokens来在客户端中检索idToken并在服务器上对其进行验证。

在服务器端，我使用以下Java代码初始化SDK并验证令牌：

  String json = // JSON generated from Firebase service account;
  ByteArrayInputStream serviceAccount =
      new ByteArrayInputStream(json.getBytes(Charsets.UTF_8));

  FirebaseOptions options =
      new FirebaseOptions.Builder()
          .setCredentials(GoogleCredentials.fromStream(serviceAccount))
          .setDatabaseUrl() // My database url
          .build();
  FirebaseApp defaultApp = FirebaseApp.initializeApp(options);
  FirebaseAuth defaultAuth = FirebaseAuth.getInstance(defaultApp);
  try {
      FirebaseToken firebaseToken = Tasks.await(
             defaultAuth.verifyIdToken(tokenFromClient));
      System.out.println("token email " + firebaseToken.getEmail());
      System.out.println("Successfully verify token");
  } catch (Exception e) {
      System.out.println("token verify error " + e);
  }

我收到此错误

java.util.concurrent.ExecutionException：com.google.firebase.auth.FirebaseAuthException：验证令牌签名时出错。

SDK API具有深层堆栈跟踪跟踪：

Caused by: com.google.firebase.auth.FirebaseAuthException: Error while verifying token signature.
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifyTokenAndSignature(FirebaseTokenVerifier.java:152)
    at com.google.firebase.auth.FirebaseAuth$2.call(FirebaseAuth.java:223)
    at com.google.firebase.auth.FirebaseAuth$2.call(FirebaseAuth.java:211)
    at com.google.firebase.tasks.Tasks$1.run(Tasks.java:82)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThreadFactory$1$1.run(ApiProxyImpl.java:1233)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThreadFactory$1.run(ApiProxyImpl.java:1227)
    at java.lang.Thread.run(Thread.java:745)
    at com.google.apphosting.runtime.ApiProxyImpl$CurrentRequestThread.run(ApiProxyImpl.java:1194)

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1953)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:220)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1379)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1407)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
    at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:104)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:981)
    at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.refresh(GooglePublicKeysManager.java:172)
    at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.getPublicKeys(GooglePublicKeysManager.java:140)
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifySignature(FirebaseTokenVerifier.java:174)
    at com.google.firebase.auth.internal.FirebaseTokenVerifier.verifyTokenAndSignature(FirebaseTokenVerifier.java:146)
    ... 10 more

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1473)
    ... 26 more

在客户端中，当获取ID令牌时，我将强制刷新设置为true，因此我认为ID令牌尚未过期。

感谢您的帮助。

Answer 1

根本原因是错误的证书。我们的服务器基于App Engine构建，但是我们根据项目需要替换了证书。解决证书问题后，令牌验证成功。

如何验证Firebase ID令牌

1 个答案: