在c#.net中验证Firebase JWT

发布时间：2020-12-15 21:03:29 所属栏目：百科来源：网络整理

导读：我正在尝试验证由firebase android客户端获取的json web令牌并传递给运行.net的服务器在答案here之后,我创建了这些方法来验证令牌并提取uid： public static async Taskstring GetUserNameFromTokenIfValid(string jsonWebToken) { const string FirebasePr

我正在尝试验证由firebase android客户端获取的json web令牌并传递给运行.net的服务器

在答案here之后,我创建了这些方法来验证令牌并提取uid：

public static async Task<string> GetUserNameFromTokenIfValid(string jsonWebToken)
    {
        const string FirebaseProjectId = "testapp-16ecd";
        try
        {
            // 1. Get Google signing keys
            HttpClient client = new HttpClient();
            client.BaseAddress = new Uri("https://www.googleapis.com/robot/v1/metadata/");
            HttpResponseMessage response = await client.GetAsync("x509/securetoken@system.gserviceaccount.com");
            if (!response.IsSuccessStatusCode) { return null; }
            var x509Data = await response.Content.ReadAsAsync<Dictionary<string,string>>();
            SecurityKey[] keys = x509Data.Values.Select(CreateSecurityKeyFromPublicKey).ToArray();

            // Use JwtSecurityTokenHandler to validate the JWT token
            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();

            // Set the expected properties of the JWT token in the TokenValidationParameters
            TokenValidationParameters validationParameters = new TokenValidationParameters()
            {
                ValidAudience = FirebaseProjectId,ValidIssuer = "https://securetoken.google.com/" + FirebaseProjectId,ValidateIssuerSigningKey = true,IssuerSigningKeys = keys
            };
            SecurityToken validatedToken;
            ClaimsPrincipal principal = tokenHandler.ValidateToken(jsonWebToken,validationParameters,out validatedToken);
            var jwt = (JwtSecurityToken)validatedToken;
            return jwt.Subject;

        }
        catch (Exception e)
        {
            return null;
        }
    }

    static SecurityKey CreateSecurityKeyFromPublicKey(string data)
    {
        return new X509SecurityKey(new X509Certificate2(Encoding.UTF8.GetBytes(data)));
    }

当我运行代码时,我得到了响应：

{"IDX10501: Signature validation failed. Unable to match 'kid': 'c2154b0435d58fc96a4480bd7655188fd4370b07',ntoken: '{"alg":"RS256","typ":"JWT","kid":"c2154b0435d58fc96a4480bd7655188fd4370b07"}......

调用https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com会返回具有匹配ID的证书：

{
 "c2154b0435d58fc96a4480bd7655188fd4370b07": "-----BEGIN CERTIFICATE-----nMIIDHDCCAgSgAwIBAgIIRZGQCmoKoNQwDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UEnAxMmc2VjdXJldG9rZW4uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wHhcNMTYxnMTIxMDA0NTI2WhcNMTYxMTI0MDExNTI2WjAxMS8wLQYDVQQDEyZzZWN1cmV0b2tlnbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADnggEPADCCAQoCggEBAKHbxqFaNQyrrrv8gocpQjES+HCum8XRQYYLRqstJ12FGtDNnp32qagCbc0x94TaBZF7tCPMgyFU8pBQP7CvCxWxoy+Xdv+52lcR0sG/kskr23E3NnJmWVHT3YwiMwdgsbWDIpWEbvJdn3DPFaapvD9BJPwNoXuFCO2vA2rhi1LuNWsaHtnBj5jTicGCnt2PGKUTXJ9q1hOFi90wxTVUVMfFqDa4g9iKqRoaNaLOo0w3VgsFPlrnMBca1fw1ArZpEGm3XHaDOiCi+EZ2+GRvdF/aPNy1+RdnUPMEEuHErULSxXpYGIdtn/Mo7QvtFXkIl6ZHvEp5pWkS8mlAJyfPrOs8RzXMCAwEAAaM4MDYwDAYDVR0TAQH/nBAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwIwDQYJnKoZIhvcNAQEFBQADggEBAJYXDQFIOC0W0ZwLO/5afSlqtMZ+lSiFJJnGx/IXI5Min0sBI3QA7QXmiNH4tVyEiK+HsFPKAYovsbh7HDypEnBGsz9UmEU6Wn6Qu9/v38+bonLant6Ds9ME7QHhKJKtYkso0F2RVwu220xZQl1yrl4bjq+2ZDncYthILjw5t+8Z4cnQW5UCr2wlVtkflGtIPR1UrvyU13eiI5SPkwOWPZvG2iTabnLfcRIkhQgIalkznMeniz8Pzpk9eT8HFeZYiB61GpIWHG4oEb1/Z4Q//os+vWDQ+X0ARTYhTEbwLLQ0dcjWnfg/tm7J+MGH5NH5MwjO+CI4fA3NoGOuEzF1vb7/hNdU=n-----END CERTIFICATE-----n"

我已经使用Java调用(在kotlin中制作)成功验证了此令牌

FirebaseAuth.getInstance().verifyIdToken(idToken).addOnSuccessListener { decodedToken ->
    val uid = decodedToken.uid
}

解决方法

我相信你现在已经找到了解决方案,但对于未来遇到这个问题的人来说.

设置X509SecurityKey的KeyId

x509Data.Select(cert => new X509SecurityKey(new X509Certificate2(Encoding.UTF8.GetBytes(cert.Value)))
            {
                KeyId = cert.Key
            })
            .ToArray()

这将允许TokenValidationParameters查找要验证的issuerKey.

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!