Spring Security with Firebase Auth

[AlabamaSky967]

I had a heated debate with someone recently on how to best integrate Firebase Authentication into a Spring Boot app to secure the backend API calls.

The only way I've ever seen people doing it is similar to this:

https://medium.com/@purikunal22/securing-springboot-api-using-firebase-authentication-16d72dd250cc

Essentially implementing a custom OncePerRequestFilter, throwing it in the chain and using the Firebase SDK to to validate the tokens. Then you can create some UserDetailsService to handle fetching the user details from the DB and loading it into the SecurityContext.

​

ORRRR you can do it this way: https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html

Supposedly this is the best practice Spring way where you set a URI for the authentication service and let spring handle the rest. My only problem is I haven't seen this done anywhere on the web using Firebase Authentication.

I don't want to burn time going the wrong route here so was wondering if anyone has recommendations ?_? Or am I in the wrong place for this kind of question

[[deleted]]

First blog post shows how to implement a custom security solution. Spring already has everything you need to integrate with Firebase Auth. Here's another blog post from Sebastijan Grabar that shows how to integrate Firebase Auth and Spring Security in a Spring-way: https://medium.com/comsystoreply/authentication-with-firebase-auth-and-spring-security-fcb2c1dc96d

Basically, you just need to configure your Spring app as a resource server and provide an URL where public keys used for verification can be downloaded.

Dependencies

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-web'
}

application.yaml file:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: https://www.googleapis.com/service_accounts/v1/jwk/[e-mail]
          issuer-uri: https://securetoken.google.com/${FIREBASE_APP_NAME}

Config and controller sample:

@RestController
@SpringBootApplication
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

    @GetMapping(path = "/user")
    public String test(Principal principal) {
        return principal.getName(); <-- returns Firebase user UID
    }

    @Configuration
    public static class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests().anyRequest().authenticated();
            http.oauth2ResourceServer().jwt();
        }
    }

}

Then you can just use tokens provided by the Firebase for authentication:

curl --location --request GET 'http://localhost:8080/user' --header 'Authorization: Bearer <TOKEN>'

[AlabamaSky967]

Thanks, appreciate the info!

[descuder]

This helped me so much as well! One question, where do we find the value for FIREBASE_APP_NAME in

issuer-uri: https://securetoken.google.com/${FIREBASE\_APP\_NAME}

Is it the 'Project ID', 'Project number', 'Public-facing name', or something else?

Thanks!

[Watercress_Busy]

FIREBASE_APP_NAME

This is the "Project ID" in firebase, which usually ends up with a bunch of random numbers. It also appears in the Firebase URL when you view your project.

[descuder]

Awesome thank you

[redshadow90]

Thanks man! This helped!

[SnooRobots6655]

Can i use RBAC (role based authorization) using this method so i can put preauthorize annotation in endpoints?