From aec4f531c28800593f25e47649e94d0f0889285d Mon Sep 17 00:00:00 2001 From: thedogrex Date: Wed, 14 Sep 2022 12:44:30 +0300 Subject: [PATCH 1/2] clock_skew_in_seconds added --- firebase_admin/_auth_client.py | 4 ++-- firebase_admin/_token_gen.py | 9 +++++---- firebase_admin/auth.py | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/firebase_admin/_auth_client.py b/firebase_admin/_auth_client.py index eaf491f3..1fb9c18a 100644 --- a/firebase_admin/_auth_client.py +++ b/firebase_admin/_auth_client.py @@ -92,7 +92,7 @@ def create_custom_token(self, uid, developer_claims=None): return self._token_generator.create_custom_token( uid, developer_claims, tenant_id=self.tenant_id) - def verify_id_token(self, id_token, check_revoked=False): + def verify_id_token(self, id_token, check_revoked=False, clock_skew_in_seconds=0): """Verifies the signature and data for the provided JWT. Accepts a signed token string, verifies that it is current, was issued @@ -124,7 +124,7 @@ def verify_id_token(self, id_token, check_revoked=False): raise ValueError('Illegal check_revoked argument. Argument must be of type ' ' bool, but given "{0}".'.format(type(check_revoked))) - verified_claims = self._token_verifier.verify_id_token(id_token) + verified_claims = self._token_verifier.verify_id_token(id_token, clock_skew_in_seconds=clock_skew_in_seconds) if self.tenant_id: token_tenant_id = verified_claims.get('firebase', {}).get('tenant') if self.tenant_id != token_tenant_id: diff --git a/firebase_admin/_token_gen.py b/firebase_admin/_token_gen.py index 32c109d5..f8cd5094 100644 --- a/firebase_admin/_token_gen.py +++ b/firebase_admin/_token_gen.py @@ -289,8 +289,8 @@ def __init__(self, app): invalid_token_error=InvalidSessionCookieError, expired_token_error=ExpiredSessionCookieError) - def verify_id_token(self, id_token): - return self.id_token_verifier.verify(id_token, self.request) + def verify_id_token(self, id_token, clock_skew_in_seconds=0): + return self.id_token_verifier.verify(id_token, self.request, clock_skew_in_seconds) def verify_session_cookie(self, cookie): return self.cookie_verifier.verify(cookie, self.request) @@ -313,7 +313,7 @@ def __init__(self, **kwargs): self._invalid_token_error = kwargs.pop('invalid_token_error') self._expired_token_error = kwargs.pop('expired_token_error') - def verify(self, token, request): + def verify(self, token, request, clock_skew_in_seconds=0): """Verifies the signature and data for the provided JWT.""" token = token.encode('utf-8') if isinstance(token, str) else token if not isinstance(token, bytes) or not token: @@ -393,7 +393,8 @@ def verify(self, token, request): token, request=request, audience=self.project_id, - certs_url=self.cert_url) + certs_url=self.cert_url, + clock_skew_in_seconds = clock_skew_in_seconds) verified_claims['uid'] = verified_claims['sub'] return verified_claims except google.auth.exceptions.TransportError as error: diff --git a/firebase_admin/auth.py b/firebase_admin/auth.py index 6902a322..8962f2ab 100644 --- a/firebase_admin/auth.py +++ b/firebase_admin/auth.py @@ -191,7 +191,7 @@ def create_custom_token(uid, developer_claims=None, app=None): return client.create_custom_token(uid, developer_claims) -def verify_id_token(id_token, app=None, check_revoked=False): +def verify_id_token(id_token, app=None, check_revoked=False, clock_skew_in_seconds=0): """Verifies the signature and data for the provided JWT. Accepts a signed token string, verifies that it is current, and issued @@ -217,7 +217,7 @@ def verify_id_token(id_token, app=None, check_revoked=False): record is disabled. """ client = _get_client(app) - return client.verify_id_token(id_token, check_revoked=check_revoked) + return client.verify_id_token(id_token, check_revoked=check_revoked, clock_skew_in_seconds=clock_skew_in_seconds) def create_session_cookie(id_token, expires_in, app=None): From 77f75f1d8ac24a404ea7f558a82a75de71220a79 Mon Sep 17 00:00:00 2001 From: thedogrex Date: Wed, 14 Sep 2022 20:02:02 +0300 Subject: [PATCH 2/2] token time update --- firebase_admin/_token_gen.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/firebase_admin/_token_gen.py b/firebase_admin/_token_gen.py index f8cd5094..7d772f6c 100644 --- a/firebase_admin/_token_gen.py +++ b/firebase_admin/_token_gen.py @@ -44,7 +44,7 @@ MAX_SESSION_COOKIE_DURATION_SECONDS = int(datetime.timedelta(days=14).total_seconds()) # Custom token constants -MAX_TOKEN_LIFETIME_SECONDS = int(datetime.timedelta(hours=1).total_seconds()) +MAX_TOKEN_LIFETIME_SECONDS = int(datetime.timedelta(minutes=15).total_seconds()) FIREBASE_AUDIENCE = ('https://identitytoolkit.googleapis.com/google.' 'identity.identitytoolkit.v1.IdentityToolkit') RESERVED_CLAIMS = set([