firebase / firebase/functions-samples
[BUG] Firebase Functions Tasks: Firebase ID token has incorrect "aud" (audience) claim.
- Dominant language
- JavaScript
- Stars
- 12.2k
- Forks
- 3.8k
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 1
Description
### Which sample has a bug?
I implemented a firebase function v1 with nodejs to be a cron scheduler to enqueue a task to python v2 firebase functions cloud task deployed in the same GCP project.
I followed the [firebase documentation](https://firebase.google.com/docs/functions/task-functions?gen=2nd#python_2) to build the python firebase function task and to build a nodejs firebase function scheduler to enqueue it.
The problem is that I am getting authentication error when queuing:
`ERROR:root:Error validating token: Firebase ID token has incorrect "aud" (audience) claim. Expected "project-Id" but got "https://mycloudtaskfunctionname-fgydghymbq-uc.a.run.app". Make sure the ID token comes from the same Firebase project as the service account used to authenticate this SDK. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve ID token.`
The error message does not make sense because the [troubleshooting documentation](https://cloud.google.com/run/docs/troubleshooting#401) states that:
> If invoked by a service account, the audience claim (aud) of the Google-signed ID token must be set to the following:
- The Cloud Run URL of the receiving service, using the form https://service-xyz.run.app
It's clear by the log and the mentioned documentation that my nodejs cloud function is queuing with correct target uri.
But I can't understand why I still getting this authentication error as it's not performed by my python cloud functions as it's only prints the request data.
firebase CLI 13.4.1
nodejs 20.11.1
"firebase-admin": "^11.11.1",
"firebase-functions": "^4.5.0",
"google-auth-library": "^8.9.0",
Python 3.12
### How to reproduce the issue
Implement queuing with firebase function v1 using nodejs.
Implement firebase function cloud task with python 3.12
**Steps to set up and reproduce**
### Debug output
I overwrite to not show my project id and my firebase task functions name.
`ERROR:root:Error validating token: Firebase ID token has incorrect "aud" (audience) claim. Expected "project-Id" but got "https://mycloudtaskfunctionname-fgydghymbq-uc.a.run.app". Make sure the ID token comes from the same Firebase project as the service account used to authenticate this SDK. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve ID token.`
**Errors in the
[console logs](https://console.firebase.google.com/project/_/functions/logs?search=&severity=DEBUG)**
**Screenshots**
### Expected behavior
Python Firebase Cloud Task should expect audience as something like https://service-xyz.run.app
### Actual behavior
Python Firebase Cloud Task expecting audience to be "my-project-Id"
Contributor guide
Assessment
This issue has not been assessed yet.