Closed geoah closed 3 years ago
When using the emulator, should the library be able to verify the custom tokens it creates?
Custom tokens are not ID tokens, and therefore cannot be verified via VerifyIDToken()
(both in emulator and production modes). Custom tokens can only be used for sign-in on a client device.
FWIW, in prod mode you get a more specific error message when verifying custom tokens via the above function:
But the ID tokens issued by the emulator do not have a kid
claim, and therefore the SDK provides the more general error message you're seeing. We can potentially improve this error handling behavior in a future release.
[READ] Step 1: Are you in the right place?
I really hope so. I'm still trying to wrap my head around firebase admin and client so I do apologise if this is not an issue of the admin library.
Thank you in advance! :D
[REQUIRED] Step 2: Describe your environment
[REQUIRED] Step 3: Describe the problem
When using the emulator, a token created with
.CustomToken
cannot be verified by.VerifyIDToken
.I guess my primary question is the following
When using the emulator, should the library be able to verify the custom tokens it creates?
Context
I'm trying to do something similar to what the docs describe in Sign in using custom tokens on clients.
I create a custom token with the admin library on the backend, pass it in the frontend and use
auth.signInWithCustomToken()
with the token to authenticate the user (doesn't return any errors). After that, callingauth.currentUser().getIdToken()
returns the custom token as I think is supposed to be doing.The thing is that if I send the token back to the server to verify as I do with normal (non-emulation) id tokens, verification throws an error.
Steps to reproduce:
Relevant Code:
I'm running this with the env var
FIREBASE_AUTH_EMULATOR_HOST
set.The prints from this are the following: