如何在不泄露Firebase Admin SDK私密信息的前提下，保障Python Firebase Cloud Messaging服务脚本的部署与功能正常？

Great question! Keeping Firebase service account keys (like private_key_id and private_key) safe while deploying your script to a server is critical—you don’t want those secrets falling into the wrong hands. Let’s break down your best options, ordered by how commonly they’re used in production:

1. Use Server Environment Variables #

This is the simplest and most widely adopted approach. Instead of storing credentials in a file, you’ll inject them into your server’s environment, then read them directly in your script.

Step 1: Extract Credentials to Environment Variables #

Take each field from your Firebase service account JSON file and set it as an environment variable on your server. For example:

• On Linux, add these to ~/.bashrc or /etc/profile (for system-wide access):

  export FIREBASE_PROJECT_ID="your-project-id"
  export FIREBASE_PRIVATE_KEY_ID="your-key-id"
  export FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
  # Add other required fields like client_email, token_uri, etc.
  

• If using Docker, create a .env file (add this to .gitignore!) with these variables, then pass it to your container with docker run --env-file .env.
• For systemd services, add Environment= lines to your service file.

Step 2: Update Your Script to Read from Environment Variables #

Modify your Python code to pull credentials from the environment instead of a file:

import os
import firebase_admin
from firebase_admin import credentials

# Build the credentials dictionary from environment variables
firebase_creds = {
    "type": "service_account",
    "project_id": os.getenv("FIREBASE_PROJECT_ID"),
    "private_key_id": os.getenv("FIREBASE_PRIVATE_KEY_ID"),
    "private_key": os.getenv("FIREBASE_PRIVATE_KEY").replace('\\n', '\n'),  # Fix newline escaping
    "client_email": os.getenv("FIREBASE_CLIENT_EMAIL"),
    "token_uri": os.getenv("FIREBASE_TOKEN_URI")
}

cred = credentials.Certificate(firebase_creds)
firebase_admin.initialize_app(cred)

2. Use a Cloud Secret Manager (Enterprise-Grade) #

If your server is hosted on a cloud platform (AWS, GCP, Azure), use their built-in secret management services. These tools handle secure storage, automatic key rotation, and fine-grained access control.

Example with GCP Secret Manager #

1. Upload your full Firebase service account JSON to GCP Secret Manager as a secret.
2. Grant your server’s service account permission to access the secret.
3. Update your script to fetch the secret at runtime:

import json
import firebase_admin
from firebase_admin import credentials
from google.cloud import secretmanager

def get_firebase_creds():
    client = secretmanager.SecretManagerServiceClient()
    # Replace with your secret's full path
    secret_name = "projects/your-gcp-project/secrets/firebase-service-account/versions/latest"
    response = client.access_secret_version(request={"name": secret_name})
    return json.loads(response.payload.data.decode("UTF-8"))

cred = credentials.Certificate(get_firebase_creds())
firebase_admin.initialize_app(cred)

3. Encrypt the Credentials File Before Deployment #

If you must keep the credentials in a file, encrypt it before uploading to the server, then decrypt it only when your script needs it.

Step 1: Encrypt the File Locally #

Use openssl to encrypt your service account JSON:

openssl enc -aes-256-cbc -salt -in service-account.json -out service-account.enc -k your-strong-encryption-key

Store the encryption key separately—don’t upload it with the encrypted file!

Step 2: Decrypt on the Server #

Add a step to decrypt the file when your script starts (use an environment variable for the encryption key):

import os
import subprocess
import firebase_admin
from firebase_admin import credentials

# Decrypt the file
decrypt_cmd = [
    "openssl", "enc", "-aes-256-cbc", "-d",
    "-in", "service-account.enc",
    "-out", "service-account-temp.json",
    "-k", os.getenv("ENCRYPTION_KEY")
]
subprocess.run(decrypt_cmd, check=True)

# Load credentials
cred = credentials.Certificate("service-account-temp.json")
firebase_admin.initialize_app(cred)

# Clean up the temporary plaintext file (optional but recommended)
os.remove("service-account-temp.json")

General Security Best Practices #

• Restrict file permissions: If you do use a credentials file (even temporarily), set strict permissions with chmod 600 service-account.json so only the script’s user can access it.
• Never commit secrets to version control: Add all sensitive files, .env files, and environment variable configs to your .gitignore.
• Rotate keys regularly: Firebase lets you generate new service account keys and revoke old ones—do this every few months to minimize risk if a key is ever exposed.

内容的提问来源于stack exchange，提问作者Deen Gangen