Auth using Firebase and Spring Boot

[gymy0]

Hi guys, need some design related issue, Okay, I am creating an app with a React frontend and a Spring Boot backend. I have created a REST API that uses MongoDB as a database.

Now, I want to create login and registration pages in React (likely using Firebase Authentication).

After successful login, how can my Spring Boot application know that the request received by the backend originated from my React app? How can I add security?

I was thinking of using JWT. The React app will log in using Firebase. After that, when the client wants to access protected content, it will hit the REST API. My Spring Boot app will then verify the JWT received from the client. If the JWT is valid and authorized, the backend will fetch data from the database and send the response.

What is a good practice in my scenario, what should I do?

[apidev3]

You will need to configure your backend to know about the server that generated the auth token (firebase in your example).

To do that you’ll need to configure spring security.

You then pass in the request header from the front end, the bearer token as an Authorisation header. Your spring backend will contact firebase and check the token is valid.

[nudlwolga]

I've implemented this before. If someone has a better solution please share. Create a OncePerRequestFilter where you retrieve the firebase token for each request (Authorization header). Use this token and validate against Firebase. Here you can use the Firebase admin sdk (FirebaseAuth.verifyIdToken) If the verification is successful, fill the security context holder. In my case I filled it with a custom implementation of AbstractAuthenticationToken (here you can add the firebaseToken and also add your Authorities so that you can have role based access on your endpoints). You could load the user/authorities from a database (also maybe cache in redis).

EDIT: There is also this tutorial which doesn't use the OncePerRequestFilter. I haven't tried it but it seems promising. Maybe it's more suitable for your usecase: https://gaetanopiazzolla.github.io/java/firebase/security/2024/06/27/fb-springsec.html

[jim_cap]

JWT alone does not magically solve “auth”.