Firebase 3.0 Tokens : [Error: Firebase Auth ID token has no "kid" claim]

Question

I'm currently developing a node.js service with firebase 3.0 that is called by a web application that uses firebase 2.4.

I'm sending the current user Firebase ID token (Auth.$getAuth().token) in my header call and trying to validade this token with

var idToken = req.headers["x-access-token"];
auth.verifyIdToken(idToken).then(function(decodedToken) {
    var uid = decodedToken.sub;
    console.log(decodedToken);
}, function(error){
    console.log(error);
});

But I'm getting:

[Error: Firebase Auth ID token has no "kid" claim]

getAuth():

---

UPDATE

I'have just tested generating and validating the token on the server side and I'm getting the same problem.

var auth = firebase.auth();
var token = auth.createCustomToken(userId, {"premium_account": true});
console.log(token);
auth.verifyIdToken(token).then(function(decodedToken) {
     console.log(decodedToken);
}, function(error){
     console.log(error);
});

Any suggestions?

---

UPDATE 2: [SOLUTION]

The problem in my case was that the Tokens generated with AngularFire 2.X.X are not compatible with the Firebase 3.X.X that is running in my server. So after digging into some thoughts that people wrote here and in this google group topic the workaround was to use jsonwebtoken as follows:

var jwt = require('jsonwebtoken');
jwt.verify(idToken, fbKey, function(err, decoded) {
   if (!err){ console.log(decoded); }
});

You can find the fbKey accessing the new firebase console and going into Settings -> Project Settings -> Database.

Answer 1

The documentation states that a Firebase ID Token is not the same as a Custom Token, and that verifyIdToken() is not intended for verifying tokens generated with generateCustomToken().

Old style custom tokens still seem to work (signed with a database secret instead of a service account private key). You can generate and verify these yourself using firebase-token-generator.js and/or jsonwebtoken.js.

Copied from Firebase Project > Settings > Database > Secrets

Create custom database authentication tokens using a legacy Firebase token generator. At least one secret must exist at all times.

Answer 2

Seems like there is no way to use firebase's createCustomToken and verifyIdToken in a couple.

Method createCustomToken uses method sign from jsonwebtoken module which does not put "kid" claim in header section of jwt by default. And createCustomToken does not put it itself.

I suppose at this time you can use jsonwebtoken module directly to generate token with own key id.

[email protected]

[email protected]