使用Firebase-PHP验证Firebase ID令牌

问题描述

我正在使用Firebase-Auth来授权我的用PHP编码的Web应用程序中的用户.授权本身是使用Javascript进行的，该Javascript是在Ajax-Request上执行以验证用户是否登录的.

I am using Firebase-Auth to authorize an user on my web-app coded in PHP. The Authorization itself is made with Javascript, which is executet on an Ajax-Request to verify, that an user is logged in.

要在服务器上使用Firebase-Admin，我已经实现了 Firebase-PHP .

To use the Firebase-Admin at the server I have implemented Firebase-PHP.

现在，在每个AJX-Request上，我都获得登录的用户ID和ID令牌，我希望在PHP中对其进行验证，就像它已被编写为此处.

On every AJX-Request I now get the logged in user ID and the ID Token, which I want to verify in PHP like it's been written here in the Docs.

验证本身可以正常工作.如果令牌存在，我将得到一个"IDToken"对象.但是，如何才能再次从该对象中获取userID来验证令牌是该用户的正确令牌呢?

The verification itself works fine. If the token exists I get an "IDToken"-Object. But how can I get the userID out of that object again to verify, that the token is the right one to that user?

$idTokenString = '...';

try {
    $verifiedIdToken = $firebase->getAuth()->verifyIdToken($idTokenString);
    // This is the Token-Object where I cant't find the uid-get-Function
} catch (InvalidIdToken $e) {
    echo $e->getMessage();
}

我在文档或搜索的类中找不到方法.

I couldn't find a method in the documentation or in the classes I searched.

推荐答案

此处的库维护者-文档确实缺少该信息，但现在包含了该信息，并且整个页面也已得到全面修订:

Maintainer of the library here - the documentation was indeed missing that information, but it is now included and the whole page has been overhauled:

https://firebase-php.readthedocs.io/en/latest/authentication.html#verify-a-firebase-id-token

您可以从ID令牌的 sub 声明中检索UID:

You can retrieve the UID from the sub claim of the ID token:

try {
    $verifiedIdToken = $firebase->getAuth()->verifyIdToken($idToken);
} catch (InvalidToken $e) {
    echo $e->getMessage();
}

$uid = $verifiedIdToken->getClaim('sub'); // lcobucci/jwt:^3.0
// or
$uid = $verifiedIdToken->claims()->get('sub'); // lcobucci/jwt:^4.0

$user = $firebase->getAuth()->getUser($uid);

这篇关于使用Firebase-PHP验证Firebase ID令牌的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！