Spring Boot中基于Firebase实现所有API调用的JWT Token验证

实现步骤 #

1. 引入Firebase依赖 #

在项目的依赖管理文件中添加Firebase Admin SDK：

<!-- Maven pom.xml -->
<dependency>
    <groupId>com.google.firebase</groupId>
    <artifactId>firebase-admin</artifactId>
    <version>9.2.0</version>
</dependency>

// Gradle build.gradle
implementation 'com.google.firebase:firebase-admin:9.2.0'

2. 初始化Firebase配置 #

创建配置类完成Firebase App的初始化：

import com.google.auth.oauth2.GoogleCredentials;
import com.google.firebase.FirebaseApp;
import com.google.firebase.FirebaseOptions;
import org.springframework.context.annotation.Configuration;

import javax.annotation.PostConstruct;
import java.io.FileInputStream;
import java.io.IOException;

@Configuration
public class FirebaseConfig {

    @PostConstruct
    public void initFirebase() throws IOException {
        // 替换为你的Firebase服务账号密钥路径
        FileInputStream serviceAccount = new FileInputStream("src/main/resources/firebase-service-account.json");

        FirebaseOptions options = new FirebaseOptions.Builder()
                .setCredentials(GoogleCredentials.fromStream(serviceAccount))
                .build();

        if (FirebaseApp.getApps().isEmpty()) {
            FirebaseApp.initializeApp(options);
        }
    }
}

3. 实现自定义Token验证过滤器 #

继承OncePerRequestFilter，嵌入你需要的核心验证逻辑：

import com.google.firebase.auth.FirebaseAuth;
import com.google.firebase.auth.FirebaseToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Collections;

public class FirebaseTokenAuthFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String idToken = extractBearerToken(request);

        if (idToken != null) {
            try {
                // 你指定的核心验证逻辑
                FirebaseToken decodedToken = FirebaseAuth.getInstance().verifyIdToken(idToken);
                UsernamePasswordAuthenticationToken authToken =
                        new UsernamePasswordAuthenticationToken(decodedToken, null, Collections.emptyList());
                SecurityContextHolder.getContext().setAuthentication(authToken);
            } catch (Exception e) {
                // Token验证失败，直接返回401
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "无效或过期的Token");
                return;
            }
        }

        filterChain.doFilter(request, response);
    }

    private String extractBearerToken(HttpServletRequest request) {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            return authHeader.substring(7);
        }
        return null;
    }
}

4. 配置Spring Security全局拦截 #

将自定义过滤器加入Spring Security过滤链，实现所有API的Token验证：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .anyRequest().authenticated() // 所有请求必须经过验证
                .and()
                .addFilterBefore(new FirebaseTokenAuthFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

额外说明 #

• 如果有无需验证的公开接口（如登录、注册），可以在configure方法中添加antMatchers("/public/**").permitAll()来排除。
• FirebaseToken中包含用户的UID、邮箱等信息，业务代码中可通过SecurityContextHolder.getContext().getAuthentication().getPrincipal()获取。

内容的提问来源于stack exchange，提问作者Siva