Firebase ID Token签名无效：客户端生成后端验证失败

问题概述 #

客户端通过Firebase Google登录生成ID Token，本地无模拟器运行；后端使用Node.js Firebase SDK验证Token时，调用firebaseAdmin.auth().verifyIdToken持续报错：

Firebase ID token has invalid signature. 请参考官方验证指南了解获取ID Token的详细说明

客户端可正常获取并发送Token，后端能接收，但验证始终失败。

客户端代码 #

const idToken = await currentUser.getIdToken()
console.log(idToken)
if (recipe.picture !== config.basePictureURL) {
     await axios.post('deletePicture', null, { headers: { authorization: 'Bearer ' + idToken } })
}

后端代码 #

var firebaseAdmin = require("firebase-admin");

var firebaseServiceAccount = require("./firebaseKey.json");

firebaseAdmin.initializeApp({credential: firebaseAdmin.credential.cert(firebaseServiceAccount)});

app.post("/deletePicture", async (req, res) => {
      console.log("authorizing user - " + req.headers['authorization'])
    
      try {
        const currentUser = await firebaseAdmin.auth().verifyIdToken(req.headers['authorization'].split(' ')[1])
        var uid = currentUser.uid;
      } catch (error) {
        console.log(error)
        console.log("Error - not a valid idToken")
        res.status(500).send(error)
      }
})

验证失败的JWT示例 #

eyJhbGciOiJSUzI1NiIsImtpZCI6IjYyM2YzNmM4MTZlZTNkZWQ2YzU0NTkyZTM4ZGFlZjcyZjE1YTBmMTMiLCJ0eXAiOiJKV1QifQ.eyJuYW1lIjoiQnJpYW4gSGFzc2FuIiwicGljdHVyZSI6Imh0dHBzOi8vbGgzLmdvb2dsZXVzZXJjb250ZW50LmNvbS9hL0FBY0hUdGRJc2xPSFUxNEdaZUZqNHJlWVM2R0RFS2RIUnAzQ1d4QVF1SWVYPXM5Ni1jIiwiaXNzIjoiaHR0cHM6Ly9zZWN1cmV0b2tlbi5nb29nbGUuY29tL3otY29tLXRoeW1lbGVzcyIsImF1ZCI6InotY29tLXRoeW1lbGVzcyIsImF1dGhfdGltZSI6MTY5MTE4MTgwOCwidXNlcl9pZCI6IkYyQUhzTllkaTVYTlZtbnlCME05TzJ4YzNoZzEiLCJzdWIiOiJGMkFIc05ZZGk1WE5WbW55QjBNOU8yeGMzaGcxIiwiaWF0IjoxNjkxMTg4NDEwLCJleHAiOjE2OTExOTIwMTAsImVtYWlsIjoiYnJpYW5AdGh5bWVsZXNzYXBwLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJmaXJlYmFzZSI6eyJpZGVudGl0aWVzIjp7Imdvb2dsZS5jb20iOlsiMTAzNjMwMDg2MzQyNDUxNDI4MTc4Il0sImVtYWlsIjpbImJyaWFuQHRoeW1lbGVzc2FwcC5jb20iXX0sInNpZ25faW5fcHJvdmlkZXIiOiJnb29nbGUuY29tIn19.LAVQy0_w2EA_QKNfku1jXMQ9fk-y7H154yBY7ri0lSX8flYiGeHBaWEhMhNPB18wZG6C4unUlBUxbvfjRDxNA5uCNKLOUrGXApGjX85LxEt1ZCSt6dqu9IVx-gGfgNOw7N6ehK_Sate_PolR8DxRNwGVUFaEsMFRSvxeSPCNl-MpZvL-QDNYIJmLpDWUghBofVTYK4MlbyCePXoGV5YNZ9RDvxJxOOV5Q5WvBT7HJFi5ptgyq3Ij6JI6CdB7tSo_L_fnwl1LHAEy08MqYoFphLZnNLnTZnIA0635tmplLf9P6jBDN_xX6kBufL6icAMM0QXWv9VCh01djMi18hE7rQ

排查步骤 #

• 核对服务账号密钥：确保后端firebaseKey.json是客户端对应Firebase项目的服务账号密钥，不要使用其他项目的密钥。
• 检查Token完整性：在后端打印拆分后的Token字符串，和客户端打印的对比，确认传输过程中没有被截断、添加空格或其他字符。
• 确认项目ID匹配：解析JWT可见aud和iss字段值为z-com-themeless，需确保后端Firebase项目的ID与此完全一致，项目ID不匹配会直接导致签名验证失败。
• 检查SDK初始化：确认firebaseAdmin.initializeApp配置正确，服务账号密钥已正确加载，没有路径或权限问题。
• 验证网络连通性：Firebase Admin SDK需要联网获取Google公钥来验证签名，确保后端服务器能正常访问相关服务，无防火墙或代理拦截。

内容的提问来源于stack exchange，提问作者Brian HK