appcheck

Documentation

Overview

Package appcheck provides functionality for verifying App Check tokens.

Index

• Variables
• type Client
  • func NewClient(ctx context.Context, conf *internal.AppCheckConfig) (*Client, error)
  • func (c *Client) VerifyToken(token string) (*DecodedAppCheckToken, error)
• type DecodedAppCheckToken

Variables

var (
	// ErrIncorrectAlgorithm is returned when the token is signed with a non-RSA256 algorithm.
	ErrIncorrectAlgorithm = errors.New("token has incorrect algorithm")
	// ErrTokenType is returned when the token is not a JWT.
	ErrTokenType = errors.New("token has incorrect type")
	// ErrTokenClaims is returned when the token claims cannot be decoded.
	ErrTokenClaims = errors.New("token has incorrect claims")
	// ErrTokenAudience is returned when the token audience does not match the current project.
	ErrTokenAudience = errors.New("token has incorrect audience")
	// ErrTokenIssuer is returned when the token issuer does not match Firebase's App Check service.
	ErrTokenIssuer = errors.New("token has incorrect issuer")
	// ErrTokenSubject is returned when the token subject is empty or missing.
	ErrTokenSubject = errors.New("token has empty or missing subject")
)

var JWKSUrl = "https://firebaseappcheck.googleapis.com/v1beta/jwks"

JWKSUrl is the URL of the JWKS used to verify App Check tokens.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is the interface for the Firebase App Check service.

func NewClient

func NewClient(ctx context.Context, conf *internal.AppCheckConfig) (*Client, error)

NewClient creates a new instance of the Firebase App Check Client.

This function can only be invoked from within the SDK. Client applications should access the the App Check service through firebase.App.

func (*Client) VerifyToken

func (c *Client) VerifyToken(token string) (*DecodedAppCheckToken, error)

VerifyToken verifies the given App Check token.

VerifyToken considers an App Check token string to be valid if all the following conditions are met:

• The token string is a valid RS256 JWT.
• The JWT contains valid issuer (iss) and audience (aud) claims that match the issuerPrefix and projectID of the tokenVerifier.
• The JWT contains a valid subject (sub) claim.
• The JWT is not expired, and it has been issued some time in the past.
• The JWT is signed by a Firebase App Check backend server as determined by the keySource.

If any of the above conditions are not met, an error is returned. Otherwise a pointer to a decoded App Check token is returned.

type DecodedAppCheckToken

type DecodedAppCheckToken struct {
	Issuer    string
	Subject   string
	Audience  []string
	ExpiresAt time.Time
	IssuedAt  time.Time
	AppID     string
	Claims    map[string]interface{}
}

DecodedAppCheckToken represents a verified App Check token.

DecodedAppCheckToken provides typed accessors to the common JWT fields such as Audience (aud) and ExpiresAt (exp). Additionally it provides an AppID field, which indicates the application ID to which this token belongs. Any additional JWT claims can be accessed via the Claims map of DecodedAppCheckToken.