firebase / firebase/firebase-functions-dart

Refactor: Replace AuthBlockingTokenVerifier with Admin SDK verifier (blocked by firebase/firebase-admin-dart#299)

Open
#222 0 comments 0 reactions 0 assignees View on GitHub
keep-open
Dominant language
Dart
Stars
44
Forks
9
Avg merge
5d 5h
Merged PRs (30d)
2

Description

### Background

Currently, `firebase_functions` maintains a standalone 280-line JWT verifier ([`AuthBlockingTokenVerifier`](https://github.com/firebase/firebase-functions-dart/blob/main/lib/src/identity/token_verifier.dart)) for Identity Platform Auth Blocking events.

This class duplicates JWKS fetching against `https://www.googleapis.com/oauth2/v3/certs`, HTTP `Cache-Control` header parsing, public key caching, and RS256 signature verification—mechanics that already exist in `firebase_admin_sdk` (which `firebase_functions` depends on).

### Problem

Maintaining a custom verifier has led to heuristic drift between Functions and Admin SDK:
* Different `Cache-Control` parsing implementations (regex vs. string splitting vs. ignored).
* Different default cache TTLs (1 hour in Functions vs. 6 hours in Admin JWKS).
* Clock-skew allowances (5 minutes on `iat`) present in Functions but absent in Admin SDK.

### Proposed Action Items

* [ ] Blocked by upstream Admin SDK refactoring (see https://github.com/firebase/firebase-admin-dart/issues/299).
* [ ] Once `firebase_admin_sdk` exposes a unified, configurable JWKS verifier with clock-skew and polymorphic audience support, deprecate and remove `AuthBlockingTokenVerifier`.
* [ ] Re-implement Auth Blocking token verification by delegating directly to the Admin SDK verifier, eliminating ~280 lines of duplicated cryptography and networking code.

Contributor guide

Open the contributing guide

Research direction

Start by reading lib/src/identity/token_verifier.dart and the blocked upstream issue firebase/firebase-admin-dart#299. Confirm that the Admin SDK exposes the required configurable JWKS verifier with clock-skew and polymorphic audience support. Done means AuthBlockingTokenVerifier is deprecated and removed, with Auth Blocking verification delegated to the Admin SDK.

Written by the indexing model from the issue text.

Assessment

Tech stack
dart
Domain
backend-api-design, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.