Java/Springboot(Maven)实现Firebase App Check后端解码问题求助

问题分析 #

你遇到的JWT.decode()失败，大概率是因为token格式问题（比如带了Bearer前缀），或者直接使用解码而非完整验证流程导致的异常。Firebase App Check的JWT是RS256签名的，需要结合公钥做完整验证，而非单纯解码。

解决方案步骤 #

1. 添加必要依赖

在pom.xml中引入auth0 JWT库和JSON解析依赖：

<dependencies>
    <!-- Auth0 JWT处理库 -->
    <dependency>
        <groupId>com.auth0</groupId>
        <artifactId>java-jwt</artifactId>
        <version>4.4.0</version> <!-- 建议使用最新稳定版 -->
    </dependency>
    <!-- JSON解析，用于获取Firebase公钥 -->
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>2.15.2</version>
    </dependency>
</dependencies>

2. 预处理App Check Token

前端传入的token通常带Bearer 前缀，必须先移除：

public String extractRawToken(String authHeader) {
    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
        throw new IllegalArgumentException("Invalid App Check token header");
    }
    return authHeader.substring(7); // 移除"Bearer "前缀
}

3. 获取Firebase App Check公钥

Firebase提供JWKS端点存储公钥，需要动态获取并解析：

import com.auth0.jwk.Jwk;
import com.auth0.jwk.JwkProvider;
import com.auth0.jwk.JwkProviderBuilder;
import com.auth0.jwt.interfaces.RSAKeyProvider;
import java.net.URL;
import java.security.interfaces.RSAPublicKey;

public class FirebaseAppCheckKeyProvider implements RSAKeyProvider {
    private final JwkProvider jwkProvider;
    private static final String JWKS_URL = "https://firebaseappcheck.googleapis.com/v1/jwks";

    public FirebaseAppCheckKeyProvider() {
        try {
            this.jwkProvider = new JwkProviderBuilder(new URL(JWKS_URL))
                    .build();
        } catch (Exception e) {
            throw new RuntimeException("Failed to initialize JWKS provider", e);
        }
    }

    @Override
    public RSAPublicKey getPublicKeyById(String keyId) {
        try {
            Jwk jwk = jwkProvider.get(keyId);
            return (RSAPublicKey) jwk.getPublicKey();
        } catch (Exception e) {
            throw new RuntimeException("Failed to get public key for key ID: " + keyId, e);
        }
    }

    @Override
    public RSAPrivateKey getPrivateKey() {
        return null; // 后端只验证，不需要私钥
    }

    @Override
    public String getPrivateKeyId() {
        return null;
    }
}

4. 完整验证App Check Token

使用JWTVerifier验证token的签名、算法、发行方、受众等核心属性：

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.auth0.jwt.interfaces.JWTVerifier;

public boolean verifyAppCheckToken(String rawToken, String projectNumber, String projectId) {
    try {
        RSAKeyProvider keyProvider = new FirebaseAppCheckKeyProvider();
        Algorithm algorithm = Algorithm.RSA256(keyProvider);

        JWTVerifier verifier = JWT.require(algorithm)
                .withIssuer("https://firebaseappcheck.googleapis.com/" + projectNumber)
                .withAudience(projectId)
                .build();

        DecodedJWT decodedJWT = verifier.verify(rawToken);
        // 验证通过后可获取token属性，比如解码后的claims
        String tokenType = decodedJWT.getClaim("token_type").asString();
        if (!"appcheck".equals(tokenType)) {
            return false;
        }
        return true;
    } catch (Exception e) {
        // 处理验证失败情况：token过期、签名无效、格式错误等
        System.err.println("App Check token verification failed: " + e.getMessage());
        return false;
    }
}

5. 在SpringBoot接口中使用

在你的API接口中注入验证逻辑：

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class ProtectedController {
    private static final String PROJECT_NUMBER = "你的Firebase项目编号";
    private static final String PROJECT_ID = "你的Firebase项目ID";

    @GetMapping("/protected")
    public String protectedEndpoint(@RequestHeader("X-Firebase-AppCheck") String appCheckHeader) {
        String rawToken = extractRawToken(appCheckHeader);
        if (verifyAppCheckToken(rawToken, PROJECT_NUMBER, PROJECT_ID)) {
            return "Access granted";
        }
        return "Access denied: Invalid App Check token";
    }
}

关键注意事项 #

• 必须验证issuer：格式为https://firebaseappcheck.googleapis.com/[你的项目编号]，不能省略项目编号
• 必须验证audience：设置为你的Firebase项目ID
• 必须确保token的token_type为appcheck
• 不要直接使用JWT.decode()，该方法仅解码不验证签名，容易引发异常或安全问题

内容的提问来源于stack exchange，提问作者Yasitha Kahangama