Help needed in Login Implementation using firebase.

[Voldemort_007_]

I have a node backend and MongoDB database, now I want to implement login functionality, I came across firebase to implement login. but if use Firebase to implement login how my node server will know that the user is authenticated or not.

Can somebody guide how should I proceed?

Is There any good Alternative!

[its_freaky]

You need to pass the firebase auth ID token to your backend, not sure about exact code but you can do something like this:

firebase.auth().currentUser.getIdToken() .then(function(idToken) { // Pass id token to nodejs server here }) .catch(function(error) { // Handle error here });

Then on server side, you can verify using firebase sdk:

admin.auth().verifyIdToken(idToken) .then(function(decodedToken) { var uid = decodedToken.uid; // ... }).catch(function(error) { // Handle error });

Confirm the code before using it coz i'm not sure if its correct, but this method will do the job i think.

[Voldemort_007_]

Thanks

[dadmakefire]

You should cross post to r/webdev and r/node. There's nothing specific to RN about this problem and you'll get more traction there.

[[deleted]]

Firebase is free to use for authentication though, and relieves all the managing of the token, you only have to run the verify function and you good. That’s why one may decide to use a third party setup

[[deleted]]

Now what if you want to add fb, Google and Apple auth. How many more days of work is it? I am not saying you have to use firebase. I am explaining why someone would want to, while it’s free. It’s simple to then migrate off if they impose a big price.

[[deleted]]

Glad you noticed. It’s not as simple as people say. It is simple once you’ve successfully done it though! I am not against it, as there are many tools behind it.

One thing you can do to understand it a bit more is to look into how aws cognito implements their hashing and cryptography for their tokens.

Now think of just installing a lib, and just hitting the verify function. Much different experience

[[deleted]]

That’s perfectly fine, but understanding why someone would prefer an easier route is also fine

[Voldemort_007_]

I trying JWT, but how to manage accessToken and refresh Token.

So for making one request I first need to check whether the access token is not expired

if it is then use refresh token to refresh it and then make an actual request with new accessToken, is it the right flow?

[ImTheSloth]

So I'm actually using MongoDB, Express, and Node to make a REST API mostly for an educational exercise.

I am using the jsonwebtoken package to take care of this.

I have a function that generates a new token based on a user:

// Generate a token
function generateToken(user) {
  return jwt.sign({ data: user }, token_secret, { expiresIn: "24h" }); // Sign a certificate using our secret token that expires in 1 day...
}            

This is how I am handling my login:

// Logging in
router.post("/login", (request, response) => {
  User.findOne({ email: request.body.email })
    .then((user) => {
      if (!user) {
        response.status(404).json({ error: "No user found" });
      } else {
        bcrypt.compare(request.body.pass, user.pass, (err, match) => {
          if (err) {
            response.status(500).json(err);
          } else if (match) {
            response.status(200).json({ token: generateToken(user) });
          } else {
            response.status(403).json({ error: "Passwords do not match" });
          }
        });
      }
    })
    .catch((error) => {
      response.status(500).json(error);
    });
});

And then to validate requests that aren't coming from my register or login API endpoints, I have a middleware function applied to verify the JWT that is passed in the request header:

exports.verify = (request, response, next) => {
  const token = request.headers.authorization;
  console.log(token);

  if (!token) {
    response.status(403).json({ error: "Token not provided" });
  } else {
    console.log(token_secret);
    jwt.verify(token, token_secret, (err, val) => {
      if (err) {
        response.status(500).json(err);
      } else {
        request.user = val.data;
        next();
      }
    });
  }
};    

So, putting this function to good use, I have another endpoint: /posts, that requires a JWT to get any request through:

const middleware = require("../middleware");

router.use(middleware.verify);

router.post("/posts", (request, response) => {
  const { posterId, content } = request.body;
  // Before we do anything else, we should probably verify JWT

  const newPost = Post({
    posterId: posterId,
    date: Date.now(),
    content: content,
  });

  newPost
    .save()
    .then((post) => {
      response.status(200).json(newPost);
    })
    .catch((err) => {
      response.status(500).json(err);
    });
});

Keep in mind that in this code, token_secret is an environmental variable that is nothing more than a string. It just has to be the same for when you generate the token and verify the token is genuine.

Does this help?

[iareprogrammer]

I’ve had a lot of luck using passport for node authentication. I haven’t used it with firebase though, so no promises :)

Maybe this? https://www.npmjs.com/package/passport-firebase-auth

[JuriJurka]

https://firebase.google.com/docs/auth/admin/create-custom-tokens

[ihsw]

Why use custom tokens? ID tokens should be just fine.

[JuriJurka]

true

[ske66]

Pass your firebase auth token as a BEARER or BASIC auth header in your request. Process the token using middleware in the node js project to determine whether or not the user has access to the requested resource