Can't access FireBase Database via HTTP/REST error 403 Forbidden

Question

Swift + Vapor framework for server + Xcode 8.1

I am trying to read Firebase Realtime Database making HTTP requests to my DB, but I get permission denied.

These are the steps:
1. create JWT sign it with secret key downloaded from "console.developers.google.com"
2. send POST request to OAuth2 server and get access token
3. send GET request to firebase database with access token received from OAuth2 server.

I get "Permission denied", HTTP/1.1 403 Forbidden

// the header of the JSON Web Token (first part of the JWT)
let headerJWT = ["alg":"RS256","typ":"JWT"]

// the claim set of the JSON Web Token
let jwtClaimSet =
  ["iss":"[email protected]",
 "scope":"https://www.googleapis.com/auth/firebase.database", //is this the correct API to access firebase database?
 "aud":"https://www.googleapis.com/oauth2/v4/token",
 "exp": expDate,
 "iat": iatDate]


drop.get("access") { request in
var accesstoken = "ya29.ElqhA-....XXXX"

 let responseFirebase = try drop.client.get("https://fir- 30c9e.firebaseio.com/data/Users.json",
  headers: ["Authorization":"Bearer \(accesstoken)"], 
     query: [:])

print("FirebaseResponse_is \(responseFirebase)")
return "success"
}

Answer 1

TLDR; Try placing auth=<TOKEN> in your query string instead of using the authorization header.

---

The Firebase documentation is unclear on how this works. According to the documentation, there are three methods that should work.

1. auth=<TOKEN> in query string (link)
2. access_token=<TOKEN> in query string (link)
3. Authorization: Bearer <TOKEN> in request header (link)

I'm not convinced that all three methods do actually work however. I'm using method 1 in my application, so I know that one works for sure.

Answer 2

The scope key was missing value https://www.googleapis.com/auth/userinfo.email

 let jwtClaimSet =
   ["iss":"[email protected]",
 "scope": "https://www.googleapis.com/auth/firebase.database  
 https://www.googleapis.com/auth/userinfo.email", 
 "aud":"https://www.googleapis.com/oauth2/v4/token",
 "exp": expDate,
 "iat": iatDate]

I found the answer browsing google groups here