(cert->public-key pem)Parse a PEM-encoded X.509 certificate string (as returned by Google's public-certs endpoint) into its java.security.PublicKey. Unlike str->private-key in fire.oauth2, CertificateFactory handles the PEM BEGIN/END wrapper itself — no manual header-stripping needed.
Parse a PEM-encoded X.509 certificate string (as returned by Google's public-certs endpoint) into its java.security.PublicKey. Unlike str->private-key in fire.oauth2, CertificateFactory handles the PEM BEGIN/END wrapper itself — no manual header-stripping needed.
(format-result claims)Flatten the claims a consumer actually reaches for out of a verified Firebase ID token. Firebase tucks the sign-in metadata away inside the token's :firebase block; this lifts it to the top level.
:sign_in_second_factor is the whole point: it names the second factor actually presented at sign-in ("totp", "phone") and is the only server-side proof that MFA happened — a valid signature alone is not. It is nil when no second factor was used, and nil on the legacy Firebase Auth tier, which never emits it. Fire reports; it does not decide. nil means "no second factor proven", and an enforcing consumer must treat that as a deny.
:second_factor_identifier is the enrollment id of the factor used, for audit trails and support tooling. Both require Identity Platform to ever be non-nil.
Flatten the claims a consumer actually reaches for out of a verified
Firebase ID token. Firebase tucks the sign-in metadata away inside the
token's :firebase block; this lifts it to the top level.
:sign_in_second_factor is the whole point: it names the second factor
actually presented at sign-in ("totp", "phone") and is the only
server-side proof that MFA happened — a valid signature alone is not.
It is nil when no second factor was used, and nil on the legacy Firebase
Auth tier, which never emits it. Fire reports; it does not decide. nil
means "no second factor proven", and an enforcing consumer must treat
that as a deny.
:second_factor_identifier is the enrollment id of the factor used, for
audit trails and support tooling. Both require Identity Platform to ever
be non-nil.(valid-signature? signing-input signature-b64url pubkey)Verify an RS256 JWT's signature against a public key. signing-input is "header.payload" (the two segments the signature actually covers).
Verify an RS256 JWT's signature against a public key. signing-input is "header.payload" (the two segments the signature actually covers).
(validate-session-cookie project-id cookie)Verify a Firebase session cookie — the long-lived, httpOnly-cookie alternative to holding an ID token, minted by fire.admin's create-session-cookie. Same RS256 verification and the same return value as validate-token, against a different key set and issuer.
Like validate-token this fails closed and returns nil on anything wrong. A revoked session is not detectable here; use fire.admin's validate-session-cookie for that.
Verify a Firebase session cookie — the long-lived, httpOnly-cookie alternative to holding an ID token, minted by fire.admin's create-session-cookie. Same RS256 verification and the same return value as validate-token, against a different key set and issuer. Like validate-token this fails closed and returns nil on anything wrong. A revoked session is not detectable here; use fire.admin's validate-session-cookie for that.
(validate-token project-id token)Verify a Firebase ID token's signature and standard claims, and that
it was issued for project-id. Returns the decoded claims map on
success, nil on any failure (bad signature, expired, wrong project,
malformed input) — deliberately fails closed and swallows exceptions,
since every failure mode here means the same thing to a caller: reject.
The claims come back with format-result's flattened keys merged over them, so the nested sign-in metadata — :sign_in_provider and, on Identity Platform, :sign_in_second_factor and :second_factor_identifier — is readable straight off the result without digging through :firebase. Nothing is dropped or renamed: the raw claims are all still there, so this stays additive for anyone already destructuring the old return value.
No service account or Admin SDK needed — this only reads Google's PUBLIC certs. For verifying a signed-in user's ID token, not for fire's own outbound calls (see create-token for that). fire.admin's validate-token adds the revocation and disabled-account checks, which do need credentials.
Verify a Firebase ID token's signature and standard claims, and that it was issued for `project-id`. Returns the decoded claims map on success, nil on any failure (bad signature, expired, wrong project, malformed input) — deliberately fails closed and swallows exceptions, since every failure mode here means the same thing to a caller: reject. The claims come back with format-result's flattened keys merged over them, so the nested sign-in metadata — :sign_in_provider and, on Identity Platform, :sign_in_second_factor and :second_factor_identifier — is readable straight off the result without digging through :firebase. Nothing is dropped or renamed: the raw claims are all still there, so this stays additive for anyone already destructuring the old return value. No service account or Admin SDK needed — this only reads Google's PUBLIC certs. For verifying a signed-in user's ID token, not for fire's own outbound calls (see create-token for that). fire.admin's validate-token adds the revocation and disabled-account checks, which do need credentials.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |