FirebaseIDToken currently provides a single useful class "Validator", which provides a single method "#check", which parses and validates an ID Token allegedly generated by Firebase auth servers.
Creating a new validator takes a single optional hash argument. If the hash has an entry for :x509_key, that value is taken to be a key as created by OpenSSL::X509::Certificate.new, and the token is validated using that key. If there is no such entry, the keys are fetched from the Firebase certs endpoint https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com. The certificates are cached for some time (default: 1 day) which can be configured by adding the :expiry argument to the initialization hash (in seconds).
This project is basically a copy of https://github.com/google/google-id-token just adopted to Firebase instead of Google tokens.
gem install firebase-id-token
validator = FirebaseIDToken::Validator.new(expiry: 1800)
begin
payload = validator.check(token, required_audience, required_client_id)
email = payload['email']
rescue FirebaseIDToken::ValidationError => e
report "Cannot validate: #{e}"
end
cert = OpenSSL::X509::Certificate.new(File.read('my-cert.pem'))
validator = FirebaseIDToken::Validator.new(x509_cert: cert)
begin
payload = validator.check(token, required_audience, required_client_id)
email = payload['email']
rescue FirebaseIDToken::ValidationError => e
report "Cannot validate: #{e}"
end