firebase / firebase-admin-go

Firebase Admin Go SDK
Apache License 2.0
1.13k stars 242 forks source link

Update snippet for importing users with Firebase scrypt hashed passwords #479

Closed thomasmburke closed 2 years ago

thomasmburke commented 2 years ago

Describe the problem

When trying to migrate users across tenants in a test app I noticed that the PasswordHash of users I moved to the new tenant was being changed to the previous tenant's PasswordHash base64 encoded again. This means when a user tries to sign in with this newly imported user the correct password will be invalid

Additionally, when exporting users I noticed that some of the users' PasswordHash had - and _ characters in it, so the previous function for decoding (base64.StdEncoding.DecodeString()) would throw an error when it encountered the byte containing that character. Instead we need to use base64 URL encoding to decode, so we need a function that does just that (base64.URLEncoding.DecodeString(s)).

The hash key on the other hand can have a / character in it so it still requires Standard base64 encoding

In short: the user's PasswordHash uses a different flavor of base 64 encoding then the signer key provided in the Firebase/Cloud Console and needs to be decoded properly before uploading a user.

google-oss-bot commented 2 years ago

I found a few problems with this issue: