验证 Firebase PNV 令牌

当 Firebase PNV 库成功验证设备的电话号码时，它 会返回经过验证的电话号码以及包含该电话号码的签名令牌。 如果您在应用客户端之外使用经过验证的电话号码，则应传递令牌，而不是电话号码本身，以便在使用时验证完整性。如需验证令牌，您可以使用任何 JWT 验证库。使用该库验证以下所有内容：

• typ 标头设置为 JWT。

• 令牌使用 Firebase PNV JWKS 端点上发布的密钥之一进行签名，所用算法为 ES256：

  https://fpnv.googleapis.com/v1beta/jwks
  

• 颁发者声明包含您的 Firebase 项目编号，格式如下：

  https://fpnv.googleapis.com/projects/FIREBASE_PROJECT_NUMBER
  

  您可以在 Firebase 控制台的项目设置页面中找到您的 Firebase 项目编号。

• 目标对象声明是一个列表，其中包含您的 Firebase 项目编号和项目 ID，格式如下：

  [
    https://fpnv.googleapis.com/projects/FIREBASE_PROJECT_NUMBER,
    https://fpnv.googleapis.com/projects/FIREBASE_PROJECT_ID,
  ]
  

• 令牌尚未过期。

示例

举个简单的例子，以下 Express.js 应用会从 HTTP POST 请求接收 Firebase PNV 令牌，并使用 JWT 验证库来检查令牌的签名和声明：

Node.js

import express from "express";
import { JwtVerifier } from "aws-jwt-verify";

// Find your Firebase project number in the Firebase console.
const FIREBASE_PROJECT_NUMBER = "123456789";

// The issuer and audience claims of the FPNV token are specific to your
// project.
const issuer = `https://fpnv.googleapis.com/projects/${FIREBASE_PROJECT_NUMBER}`;
const audience = `https://fpnv.googleapis.com/projects/${FIREBASE_PROJECT_NUMBER}`;

// The JWKS URL contains the current public signing keys for FPNV tokens.
const jwksUri = "https://fpnv.googleapis.com/v1beta/jwks";

// Configure a JWT verifier to check the following:
// - The token is signed by Google
// - The issuer and audience claims match your project
// - The token has not yet expired (default behavior)
const fpnvVerifier = JwtVerifier.create({ issuer, audience, jwksUri });

const app = express();

app.post('/verifiedPhoneNumber', async (req, res) => {
    if (!req.body) return res.sendStatus(400);
    // Get the token from the body of the request.
    const fpnvToken = req.body;
    try {
        // Attempt to verify the token using the verifier configured
        previously.
        const verifiedPayload = await fpnvVerifier.verify(fpnvToken);

        // If verification succeeds, the subject claim of the token contains the
        // verified phone number. You can use this value however it's needed by
        // your app.
        const verifiedPhoneNumber = verifiedPayload.sub;
        // (Do something with it...)

        return res.sendStatus(200);
    } catch {
        // If verification fails, reject the token.
        return res.sendStatus(400);
    }
});

app.listen(3000);