@@ -20,14 +20,15 @@ app.post('/sessionLogin', (req, res) => {
20
20
// The session cookie will have the same claims as the ID token.
21
21
// To only allow session cookie setting on recent sign-in, auth_time in ID token
22
22
// can be checked to ensure user was recently signed in before creating a session cookie.
23
- admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) . then ( ( sessionCookie ) => {
24
- // Set cookie policy for session cookie.
25
- const options = { maxAge : expiresIn , httpOnly : true , secure : true } ;
26
- res . cookie ( 'session' , sessionCookie , options ) ;
27
- res . end ( JSON . stringify ( { status : 'success' } ) ) ;
28
- } , error => {
29
- res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
30
- } ) ;
23
+ admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} )
24
+ . then ( ( sessionCookie ) => {
25
+ // Set cookie policy for session cookie.
26
+ const options = { maxAge : expiresIn , httpOnly : true , secure : true } ;
27
+ res . cookie ( 'session' , sessionCookie , options ) ;
28
+ res . end ( JSON . stringify ( { status : 'success' } ) ) ;
29
+ } , error => {
30
+ res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
31
+ } ) ;
31
32
} ) ;
32
33
// [END session_login]
33
34
@@ -37,16 +38,17 @@ app.post('/verifyToken', (req, res) => {
37
38
// Set session expiration to 5 days.
38
39
const expiresIn = 60 * 60 * 24 * 5 * 1000 ;
39
40
// [START check_auth_time]
40
- admin . auth ( ) . verifyIdToken ( idToken ) . then ( ( decodedIdToken ) => {
41
- // Only process if the user just signed in in the last 5 minutes.
42
- if ( new Date ( ) . getTime ( ) / 1000 - decodedIdToken . auth_time < 5 * 60 ) {
43
- // Create session cookie and set it.
44
- return admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) ;
45
- }
46
- // A user that was not recently signed in is trying to set a session cookie.
47
- // To guard against ID token theft, require re-authentication.
48
- res . status ( 401 ) . send ( 'Recent sign in required!' ) ;
49
- } ) ;
41
+ admin . auth ( ) . verifyIdToken ( idToken )
42
+ . then ( ( decodedIdToken ) => {
43
+ // Only process if the user just signed in in the last 5 minutes.
44
+ if ( new Date ( ) . getTime ( ) / 1000 - decodedIdToken . auth_time < 5 * 60 ) {
45
+ // Create session cookie and set it.
46
+ return admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) ;
47
+ }
48
+ // A user that was not recently signed in is trying to set a session cookie.
49
+ // To guard against ID token theft, require re-authentication.
50
+ res . status ( 401 ) . send ( 'Recent sign in required!' ) ;
51
+ } ) ;
50
52
// [END check_auth_time]
51
53
} ) ;
52
54
@@ -57,28 +59,32 @@ app.post('/profile', (req, res) => {
57
59
// Verify the session cookie. In this case an additional check is added to detect
58
60
// if the user's Firebase session was revoked, user deleted/disabled, etc.
59
61
admin . auth ( ) . verifySessionCookie (
60
- sessionCookie , true /** checkRevoked */ ) . then ( ( decodedClaims ) => {
61
- serveContentForUser ( '/profile' , req , res , decodedClaims ) ;
62
- } ) . catch ( error => {
63
- // Session cookie is unavailable or invalid. Force user to login.
64
- res . redirect ( '/login' ) ;
65
- } ) ;
62
+ sessionCookie , true /** checkRevoked */ )
63
+ . then ( ( decodedClaims ) => {
64
+ serveContentForUser ( '/profile' , req , res , decodedClaims ) ;
65
+ } )
66
+ . catch ( error => {
67
+ // Session cookie is unavailable or invalid. Force user to login.
68
+ res . redirect ( '/login' ) ;
69
+ } ) ;
66
70
} ) ;
67
71
// [END session_verify]
68
72
69
73
app . post ( '/verifySessionCookie' , ( req , res ) => {
70
74
const sessionCookie = req . cookies . session || '' ;
71
75
// [START session_verify_with_permission_check]
72
- admin . auth ( ) . verifySessionCookie ( sessionCookie , true ) . then ( ( decodedClaims ) => {
73
- // Check custom claims to confirm user is an admin.
74
- if ( decodedClaims . admin === true ) {
75
- return serveContentForAdmin ( '/admin' , req , res , decodedClaims ) ;
76
- }
77
- res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
78
- } ) . catch ( error => {
79
- // Session cookie is unavailable or invalid. Force user to login.
80
- res . redirect ( '/login' ) ;
81
- } ) ;
76
+ admin . auth ( ) . verifySessionCookie ( sessionCookie , true )
77
+ . then ( ( decodedClaims ) => {
78
+ // Check custom claims to confirm user is an admin.
79
+ if ( decodedClaims . admin === true ) {
80
+ return serveContentForAdmin ( '/admin' , req , res , decodedClaims ) ;
81
+ }
82
+ res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
83
+ } )
84
+ . catch ( error => {
85
+ // Session cookie is unavailable or invalid. Force user to login.
86
+ res . redirect ( '/login' ) ;
87
+ } ) ;
82
88
// [END session_verify_with_permission_check]
83
89
} ) ;
84
90
@@ -94,13 +100,16 @@ app.post('/sessionLogout', (req, res) => {
94
100
app . post ( '/sessionLogout' , ( req , res ) => {
95
101
const sessionCookie = req . cookies . session || '' ;
96
102
res . clearCookie ( 'session' ) ;
97
- admin . auth ( ) . verifySessionCookie ( sessionCookie ) . then ( ( decodedClaims ) => {
103
+ admin . auth ( ) . verifySessionCookie ( sessionCookie )
104
+ . then ( ( decodedClaims ) => {
98
105
return admin . auth ( ) . revokeRefreshTokens ( decodedClaims . sub ) ;
99
- } ) . then ( ( ) => {
100
- res . redirect ( '/login' ) ;
101
- } ) . catch ( ( error ) => {
106
+ } )
107
+ . then ( ( ) => {
102
108
res . redirect ( '/login' ) ;
103
- } ) ;
109
+ } )
110
+ . catch ( ( error ) => {
111
+ res . redirect ( '/login' ) ;
112
+ } ) ;
104
113
} ) ;
105
114
// [END session_clear_and_revoke]
106
115
0 commit comments