kreait/firebase-tokens

A library to work with Firebase tokens

Fund package maintenance!
jeromegamez

Installs: 1 623 059

Dependents: 8

Suggesters: 0

Security: 0

Stars: 110

Watchers: 4

Forks: 21

Open Issues: 2

1.10.0 2020-01-14 16:43 UTC

This package is auto-updated.

Last update: 2020-05-08 21:42:36 UTC


README

A library to work with Google Firebase tokens. You can use it to create custom tokens and verify ID Tokens.

Achieve more with the Firebase Admin SDK for PHP (which uses this library).

Current version Supported PHP version Monthly Downloads Total Downloads Build Status Coverage Discord Sponsor

Installation

composer require kreait/firebase-tokens

Simple usage

Create a custom token

More information on what a custom token is and how it can be used can be found in Google's official documentation.

<?php

use Kreait\Firebase\JWT\CustomTokenGenerator;

$clientEmail = '...';
$privateKey = '...';

$generator = CustomTokenGenerator::withClientEmailAndPrivateKey($clientEmail, $privateKey);
$token = $generator->createCustomToken('uid', ['first_claim' => 'first_value' /* ... */]);

echo $token;
// Output: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.e...

Verify an ID token

The ID token verification methods included in the Firebase Admin SDKs are meant to verify ID tokens that come from the client SDKs, not the custom tokens that you create with the Admin SDKs. See Auth tokens for more information.

<?php

use Kreait\Firebase\JWT\Error\IdTokenVerificationFailed;
use Kreait\Firebase\JWT\IdTokenVerifier;

$projectId = '...';
$idToken = 'eyJhb...'; // An ID token given to your backend by a Client application

$verifier = IdTokenVerifier::createWithProjectId($projectId);

try {
    $token = $verifier->verifyIdToken($idToken);
} catch (IdTokenVerificationFailed $e) {
    echo $e->getMessage();
    // Example Output:
    // The value 'eyJhb...' is not a verified ID token:
    // - The token is expired.
    exit;
}

try {
    $token = $verifier->verifyIdTokenWithLeeway($idToken, $leewayInSeconds = 10000000);
} catch (IdTokenVerificationFailed $e) {
    print $e->getMessage();
    exit;
}

Tokens

Tokens returned from the Generator and Verifier are instances of Kreait\Firebase\JWT\Token and represent a JWT. The displayed outputs are examples and vary depending on the information associated with the given user in your project's auth database.

According to the JWT specification, you can expect the following payload fields to be always available: iss, aud, auth_time, sub, iat, exp. Other fields depend on the authentication method of the given account and the information stored in your project's Auth database.

$token = $verifier->verifyIdToken('eyJhb...'); // An ID token given to your backend by a Client application

echo json_encode($token->headers(), JSON_PRETTY_PRINT);
// {
//     "alg": "RS256",
//     "kid": "e5a91d9f39fa4de254a1e89df00f05b7e248b985",
//     "typ": "JWT"
// }                                                   

echo json_encode($token->payload(), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
// {
//     "name": "Jane Doe",
//     "picture": "https://domain.tld/picture.jpg",
//     "iss": "https://securetoken.google.com/your-project-id",
//     "aud": "your-project-id",
//     "auth_time": 1580063945,
//     "user_id": "W0IturDwy4TYTmX6ilkd2ZbAXRp2",
//     "sub": "W0IturDwy4TYTmX6ilkd2ZbAXRp2",
//     "iat": 1580063945,
//     "exp": 1580067545,
//     "email": "jane@doe.tld",
//     "email_verified": true,
//     "phone_number": "+1234567890",
//     "firebase": {
//         "identities": {
//             "phone": [
//                 "+1234567890"
//             ],
//             "email": [
//                 "jane@doe.tld"
//             ]
//         },
//         "sign_in_provider": "custom"
//     }
// }

echo $token->toString();
// eyJhb...

$tokenString = (string) $token; // string
// eyJhb...

Advanced usage

Cache results from the Google Secure Token Store

In order to verify ID tokens, the verifier makes a call to fetch Firebase's currently available public keys. The keys are cached in memory by default.

If you want to cache the public keys more effectively, you can initialize the verifier with an implementation of psr/simple-cache or psr/cache to reduce the amount of HTTP requests to Google's servers.

Here's an example using the Symfony Cache Component:

use Kreait\Firebase\JWT\IdTokenVerifier;
use Symfony\Component\Cache\Simple\FilesystemCache;

$cache = new FilesystemCache();

$verifier = IdTokenVerifier::createWithProjectIdAndCache($projectId, $cache);

License

The MIT License (MIT). Please see License File for more information.