I'm making a chrome extension that uses Firebase database. For their custom authentication I need to create a JWT token to have the user sign in.
I saw on their documentation that their is a function to generate these tokens in node using the function call:
var customToken = firebase.auth().createCustomToken(uid);
My issue is that my chrome extension is not a node app, so I don't have access to this function. I have the firebase auth API from their CDN but when I try using that function I get firebase.auth(...).createCustomToken is not a function.
I guess that the create JWT token function is just for node.js firebase users. Is there a way I can still get access to this token generator without my extension being a node app?
I'm new to this JWT stuff so really I'm just looking for an easy way to generate one of these tokens somehow.
Creating a custom token requires access to the service account of your Firebase project. This is a server-side secret and should never be present in the clients that access your project. If you give your clients the secret needed to mint a custom token, you're giving them full access to your project. You might as well not use authentication in that case.
The typical approach is to run a server that mints a custom token based on your app's needs and then use that token in your client (e.g. a chrome extension) to sign in.
Alternatively you can use one of the built-in authentication methods, such as email+password, Facebook, Google or even anonymous sign-in.
Related
Instead of using the normal firebase authentication methods I want to use web3 (specifically metamask) to provide signup/login without the need of email and passwords. The problem is, how do I handle signups?
One way I thought of doing it would be to use the users wallet address as the email and just add my domain as the # part for example: 0x0000000000000000000000000000000000000000#example.com but then the problem is how do I add a password for firebase to use?
Is there anyway to authenticate using metamask?
I wish I had seen this question earlier, We have developed a mechanism just for this requires a server that runs the firebase-admin that mints a custom token and pass it to the client and signs in with signInWithCustomToken.
The code is here https://github.com/novum-insights/sveltekit-unlock-firebase.
This is a boilerplate that uses sveltekit and paywalls the user with unlock-protocol.
I need to authenticate users in browser (not mobile app) using AWS Cognito with username/pass, not FB/google IdProviders.
There are a lot of docs but they seem to be separate blocks which either incomplete, do not fit the requirements or do not fit each others :(
I created Cognito User Pool, then Identity pool and tied the userPool to the idPool, then I stuck. Do not know which library to use and how to use it.
The closest I find are:
https://aws.amazon.com/sdk-for-browser/ but my experience is not enough to convert their FB samples to not-using FB
https://github.com/aws/aws-amplify but using this lib I'll have to study React/Angular from the very beginning (I'm not a front-end developer, sorry) and I have no clue how to convert their npm-based samples to front-end javascript (npm is for NodeJS thus back-end, isn't it?).
All I need is plain html form with username/pass, send the request to Cognito and a way to check during the next page load whether the password was correct. If it matters I will use AWS Lambda as back-end for processing future tasks.
How can I do it? Is there a tutorial/doc for my case?
Thank you.
You can use AWS Cognito UserPools Hosted UI for your use case. The simplest form of authentication is using the Implicit Grant.
For more information about setting up Hosted UI refer Add an App to Enable the Hosted Web UI.. This will create a UserPool where users can register them self (If you plan to restrict this, you will need to either add users using the AWS Web Console, Cognito UserPools or using their SDK)
The steps are as follows.
Set up Cognito Hosted UI and register your application domain. This will create the login/registration pages for you where each of this will have a unique URL. What you have to do is, if the user is not authenticated (Let's discuss how to detect it later), you need to redirect the user to the Login page.
In the Login URL, you also need to specify the redirect back URL to the application so that after a successful login, Cognito will redirect back the user to the application providing the token in a query string.
You can then access the id_token from inside the application and use it for querying the backend.
Since the id_token is a JWT token you can verify it at your Backend using the public key available at the Cognito token endpoint.
To implement the JWT verification, you can also refer Cognito JWT Token validator NodeJS module.
Note: If you need to keep the user's logged in for a longer time period (Than 1 hr), you might need to use the Code Grant flow which will return a Refresh Token, which could be used to retrieve new id_tokens programmatically.
PROBLEM: There are two Firebase services (Cloud Messaging and Authentication) we want to combine in our project. The goal is to set FCM token a value we already know, not the one generated by FirebaseInstanceId.getInstance().getToken(). Thus the same token is used to get authorized both on custom server and Firebase server. Moreover multiple application instances would have been reached with one token and would have accepted the same message.
RESEARCH:
Sending a Message to Multiple Registration Tokens,
Creating Custom Tokens.
QUESTION:
Are these services supposed to be combined?
Is FirebaseInstanceId.getInstance().getToken() equal to what FirebaseAuth.getInstance().createCustomToken(uid) generates?
Is it safe to set an FCM token from client (message redirected to unsupposed device if hacked)?
No. The FCM service and Auth service are different and standalone -- one could be used without the other.
No. The token generated by the getToken() is the token that should be used to target the corresponding device for push notifications, createCustomToken() generates a token for authentication.
The FCM token is generated by calling the FirebaseInstanceId service on the client side -- it's the common usage, so yeah, I'd say it's safe.
I'm trying to call the Twitter API from Zapier using "Webhooks by Zapier", but do not manage to authenticate correctly via OAuth 1.0.
Using a REST client like Postman, it is a piece of cake. You just pass the consumer key, consumer secret, token and token secret, and set the signature method to HMAC-SHA1. Plus you check "Encode OAuth signature". The client calculates the signature.
I'm looking for a way to calculate this signature in Zapier (possibly using the built-in Python and Javascript modules), but haven't managed so far. If possible, it opens a whole range of possibilities (using the easy connectivity to other apps).
Similar to How do I make a Tweet in Zapier code.
Get that access token and then use your own token and set a header!
I am trying to list the files and folders that are in the Dropbox by using JavaScript. Can anyone suggest me how to get access token programmatically.
I can generate access token manually but I need to get from code.
To programmatically get an access token for a user, your app needs to send them through the OAuth app authorization flow. When directly using JavaScript, ideally you'd use an SDK or library, e.g.,:
https://www.dropbox.com/developers/datastore/sdks/js
(Note that the Datastore API functionality is deprecated, but the rest isn't.)
The tutorial will guide you through linking an account:
https://www.dropbox.com/developers/datastore/tutorial/js
There's also more documentation and resources here:
https://www.dropbox.com/developers/datastore/docs/js
https://github.com/dropbox/dropbox-js
There's also an OAuth guide here that should serve as a good reference about the OAuth flow:
https://www.dropbox.com/developers/reference/oauthguide
Otherwise, if you want or need to implement this manually, the following blog posts may be helpful:
for OAuth 1: https://blogs.dropbox.com/developers/2012/07/using-oauth-1-0-with-the-plaintext-signature-method/
for OAuth 2: https://blogs.dropbox.com/developers/2013/07/using-oauth-2-0-with-the-core-api/