Update signing logic for correct custom token format by kosukesaigusa · Pull Request #23 · firebase/firebase-admin-dart

kosukesaigusa · 2024-02-09T10:33:24Z

Background

Create custom token here:

final adminApp = FirebaseAdminApp.initializeApp(
  'project-id',
  Credential.fromServiceAccountParams(
    clientId: 'client-id',
    privateKey: 'private-key',
    email: 'email',
  ),
);
final auth = Auth(adminApp);
final customToken = await auth.createCustomToken('some-user-id');
print('customToken: $customToken');

Then, try to use the custom token to sign in Firebase Auth with on Flutter client app:

final userCredential = await FirebaseAuth.instance.signInWithCustomToken(customToken);

The exception like the following is thrown:

FirebaseAuthException ([firebase_auth/invalid-custom-token] The custom token format is incorrect. Please check the documentation.)

If I use the custom token created by JS (TS) SDK by the same project service account on my Flutter client app, it successfully signs in.

admin.initializeApp({
    credential: admin.credential.cert(serviceAccount),
    databaseURL: `https://${serviceAccount.projectId}.firebaseio.com`
})

const main = async () => {
    const customToken = await admin.auth().createCustomToken(`some-user-id`)
    console.log(`customToken: ${customToken}`)
}

main()

I noticed the length of custom tokens are different from each other.

# Example of created custom token by this package:
eyJ*****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************z0A

# Example of created custom token by JS (TS) SDK:
eyJ****************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************uFA

Then this PR fixes the RSA-SHA256 signing logic using pointycastle package instead of crypto package.

After the change,

The length of created custom tokens is the same as the ones created by JS (TS) SDK.
Successful signing with custom token is confirmed.

I am so excited by and curious about this project, enabling us to write Firebase Admin SDK server-side code by Dart!

Thank you so much for developing such a wonderful project!

CLAassistant · 2024-02-09T10:33:33Z

All committers have signed the CLA.

rrousselGit · 2024-02-28T11:23:30Z

Hello! Sorry for the delay.

We'd need tests for this. Could you add those? Otherwise LGTM

rrousselGit · 2024-02-28T11:25:46Z

packages/dart_firebase_admin/lib/src/utils/crypto_signer.dart

+    final privateKeyDER = base64Decode(privateKeyString);
+
+    final asn1Parser = ASN1Parser(Uint8List.fromList(privateKeyDER));
+    final topLevelSequence = asn1Parser.nextObject() as ASN1Sequence;


Too many casts and ! in there. Could you remove those? Such as by using is and != null

We'd also need tests for when those values are invalid

@rrousselGit

Thank you! I'd like you to give some advice about this point!

I'm thinking to improve the code like the following to reduce as casting and !:

crypto_signer.dart

RSAPrivateKey _parsePrivateKeyFromPem() { final privateKeyString = credential.privateKey .replaceAll('-----BEGIN PRIVATE KEY-----', '') .replaceAll('-----END PRIVATE KEY-----', '') .replaceAll('\n', ''); final privateKeyDER = base64Decode(privateKeyString); final asn1Parser = ASN1Parser(Uint8List.fromList(privateKeyDER)); final topLevelSequence = asn1Parser.nextObject(); if (topLevelSequence is! ASN1Sequence) { throw const FormatException('Invalid ASN1 format for private key'); } final privateKeyOctet = topLevelSequence.elements?[2]; if (privateKeyOctet is! ASN1OctetString) { throw const FormatException('Invalid ASN1 format for private key'); } final privateKeyParser = ASN1Parser(privateKeyOctet.valueBytes); final privateKeySequence = privateKeyParser.nextObject(); if (privateKeySequence is! ASN1Sequence) { throw const FormatException('Invalid ASN1 format for private key'); } final modulus = privateKeySequence.elements?[1]; final exponent = privateKeySequence.elements?[3]; final p = privateKeySequence.elements?[4]; final q = privateKeySequence.elements?[5]; if (modulus is! ASN1Integer || exponent is! ASN1Integer || p is! ASN1Integer || q is! ASN1Integer) { throw const FormatException('Invalid ASN1 format for private key'); } return RSAPrivateKey( modulus.integer!, exponent.integer!, p.integer, q.integer, ); }

and tried to write the unit test for success case like the following:

crypto_signer_test.dart

test('parsePrivateKeyFromPem should parse valid private key', () { final credential = Credential.fromServiceAccountParams( clientId: 'id', privateKey: _fakeRSAKey, email: 'email', ); final app = FirebaseAdminApp.initializeApp('project-id', credential); final signer = cryptoSignerFromApp(app); expect(signer, isA<CryptoSigner>()); expect(signer.algorithm, 'RS256'); final buffer = Uint8List.fromList(List.generate(32, (i) => i)); expect(() async => signer.sign(buffer), returnsNormally); });

However, when I try to write test to confirm the code throwing the FormatException, I need to give invalid private key string to Credential.fromServiceAccountParams, and it throws Invalid DER encoding error before reaching _ServiceAccountSigner.sign (_ServiceAccountSigner._parsePrivateKeyFromPem) method.

https://github.com/google/googleapis.dart/blob/3e5b68f7a81353f8a18ac75ec46c4e1fff2a9b06/googleapis_auth/lib/src/crypto/pem.dart#L100-L102

I think _ServiceAccountSigner is private, so unit test has to be started with the public cryptoSignerFromApp function, which is expected to given FirebaseAdminApp instance.

I appreciate if you have any ideas about it!

One way to do it is to make _ServiceAccountSigner "public", but have export ... hide ServiceAccountSigner.

Make sure to make ServiceAccountSigner with @internal as you do so.

kosukesaigusa · 2024-02-28T12:06:11Z

@rrousselGit

Thank you for your comment!

I will add tests and update the code based on your feedback!

PR with fix in upstream: firebase#23

gildaswise · 2024-08-07T19:18:55Z

Any updates on this? This lib is still not working with createCustomToken

labrom · 2024-11-08T22:35:20Z

packages/dart_firebase_admin/lib/src/utils/crypto_signer.dart

-    final key = utf8.encode(credential.privateKey);
-    final hmac = Hmac(sha256, key);
-    final digest = hmac.convert(buffer);
+    final rsaPrivateKey = _parsePrivateKeyFromPem();


Just a suggestion: https://github.com/jonasroussel/dart_jsonwebtoken comes with a convenient RSAPrivateKey(String pem) constructor. Could this be used instead of all the ASN1 code?

This seems to do the trick (it passes the test in crypto_signer_test.dart):

return JWTAlgorithm.RS256.sign(RSAPrivateKey(credential.privateKey), buffer);

rrousselGit · 2025-02-25T16:33:11Z

(I'm adding tests to this, and will merge)

rrousselGit · 2025-03-20T11:40:48Z

I ended-up switching to using Jose for implementing sign-in when working on app_check. This fixes the issue

kosukesaigusa added 3 commits February 9, 2024 18:57

build: add pointycastle package to dependency

a0b6481

feat: fix _ServiceAccountSigner sign method to correctly sign token

963adf2

build: remove crypto package from dependency

45f2109

The0xArchitect mentioned this pull request Feb 12, 2024

createCustomToken generates invalid Token #16

Closed

rrousselGit reviewed Feb 28, 2024

View reviewed changes

blaugold added a commit to lotum/dart_firebase_admin that referenced this pull request Mar 19, 2024

Sign custom token with RS256 algorithm

7bdb5e7

PR with fix in upstream: firebase#23

labrom reviewed Nov 8, 2024

View reviewed changes

Merge branch 'main' into fix/custom_token_format

de3f257

rrousselGit closed this Mar 20, 2025

JaredEzz mentioned this pull request Feb 17, 2026

fix(auth): use base64url encoding for JWT segments in createCustomToken #167

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update signing logic for correct custom token format#23

Update signing logic for correct custom token format#23
kosukesaigusa wants to merge 4 commits intofirebase:mainfrom
kosukesaigusa:fix/custom_token_format

kosukesaigusa commented Feb 9, 2024 •

edited

Loading

Uh oh!

CLAassistant commented Feb 9, 2024 •

edited

Loading

Uh oh!

rrousselGit commented Feb 28, 2024 •

edited

Loading

Uh oh!

rrousselGit Feb 28, 2024

Uh oh!

kosukesaigusa Feb 28, 2024 •

edited

Loading

Uh oh!

rrousselGit Oct 10, 2024

Uh oh!

kosukesaigusa commented Feb 28, 2024

Uh oh!

gildaswise commented Aug 7, 2024

Uh oh!

labrom Nov 8, 2024

Uh oh!

labrom Nov 13, 2024 •

edited

Loading

Uh oh!

rrousselGit commented Feb 25, 2025

Uh oh!

rrousselGit commented Mar 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

kosukesaigusa commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

Uh oh!

CLAassistant commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rrousselGit commented Feb 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rrousselGit Feb 28, 2024

Choose a reason for hiding this comment

Uh oh!

kosukesaigusa Feb 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rrousselGit Oct 10, 2024

Choose a reason for hiding this comment

Uh oh!

kosukesaigusa commented Feb 28, 2024

Uh oh!

gildaswise commented Aug 7, 2024

Uh oh!

labrom Nov 8, 2024

Choose a reason for hiding this comment

Uh oh!

labrom Nov 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rrousselGit commented Feb 25, 2025

Uh oh!

rrousselGit commented Mar 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kosukesaigusa commented Feb 9, 2024 •

edited

Loading

CLAassistant commented Feb 9, 2024 •

edited

Loading

rrousselGit commented Feb 28, 2024 •

edited

Loading

kosukesaigusa Feb 28, 2024 •

edited

Loading

labrom Nov 13, 2024 •

edited

Loading