Class: FireJWT::Validator

Inherits:
Object
  • Object
show all
Defined in:
lib/firejwt/validator.rb

Overview

Validator validates tokens applying guidelines outlined in firebase.google.com/docs/auth/admin/verify-id-tokens#verify_id_tokens_using_a_third-party_jwt_library.

Instance Method Summary collapse

Constructor Details

#initialize(project_id) ⇒ Validator

Returns a new instance of Validator.

Parameters:

  • project_id (String) —

    the unique identifier for your Firebase project, which can be found in the URL of that project's console.



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/firejwt/validator.rb', line 12

def initialize(project_id)
  project_id = project_id.to_s

  @certs = Certificates.new
  @opts  = {
    algorithms: %w[RS256].freeze,

    # exp must be in the future, iat must be in the past
    verify_expiration: true,
    verify_iat: true,

    # aud must be your Firebase project ID
    verify_aud: true, aud: project_id,

    # iss must be "https://securetoken.google.com/<projectId>"
    verify_iss:  true, iss: "https://securetoken.google.com/#{project_id}",
  }
end

Instance Method Details

#decode(token) ⇒ FireJWT::Token

Returns the token.

Parameters:

  • token (String) —

    the token string

Returns:

Raises:

  • (JWT::InvalidSubError) 


34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/firejwt/validator.rb', line 34

def decode(token)
  payload, header = JWT.decode token, nil, true, **@opts do |header|
    @certs.get(header['kid'])
  end

  # sub must be a non-empty string
  sub = payload['sub']
  raise(JWT::InvalidSubError, 'Invalid subject. Expected non-empty string') unless sub.is_a?(String) && !sub.empty?

  # auth_time must be in the past
  aut = payload['auth_time']
  raise(InvalidAuthTimeError, 'Invalid auth_time') if !aut.is_a?(Numeric) || aut.to_f > Time.now.to_f

  Token.new(payload, header)
end