如何在Firebase中安全存储OAuth 2.0凭证？动态刷新令牌存储方案

Great question—storing dynamically generated OAuth refresh tokens securely in Firebase is a common need, and you’ve already got the right instinct avoiding hardcoding or static environment variables. Here are the most secure options within the Firebase/GCP ecosystem, tailored for your use case:

1. Encrypted Firestore with Strict Security Rules #

This is the most seamless option if you’re already using Firebase’s Firestore. The key is to encrypt the refresh token before storing it (adding a layer on top of Firestore’s default at-rest encryption) and lock down access with granular security rules.

How to implement it: #

• Use a fixed encryption key stored in Firebase Functions environment variables (this key doesn’t change, so it’s safe to put here).
• Encrypt the token in your Function before writing to Firestore. Example code snippet:

  const crypto = require('crypto');
  const admin = require('firebase-admin');
  admin.initializeApp();
  
  // Pull encryption key from env vars (set via `firebase functions:config:set crypto.key="your-256-bit-key"`)
  const encryptionKey = Buffer.from(functions.config().crypto.key, 'hex');
  
  function encryptToken(token) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv('aes-256-cbc', encryptionKey, iv);
    let encrypted = cipher.update(token, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    return { iv: iv.toString('hex'), encryptedToken: encrypted };
  }
  
  // Store encrypted token in Firestore
  async function saveRefreshToken(userId, refreshToken) {
    const encryptedData = encryptToken(refreshToken);
    await admin.firestore()
      .collection('secure-tokens')
      .doc(userId)
      .set({ encryptedToken: encryptedData, timestamp: admin.firestore.FieldValue.serverTimestamp() });
  }
  

• Configure Firestore security rules to restrict access only to your Functions’ service account:

  rules_version = '2';
  service cloud.firestore {
    match /databases/{database}/documents {
      match /secure-tokens/{userId} {
        allow read, write: if request.auth != null && request.auth.token.email == 'your-project-id@appspot.gserviceaccount.com';
      }
    }
  }
  

2. Google Cloud Secret Manager #

If you’re leveraging GCP alongside Firebase, Cloud Secret Manager is purpose-built for storing sensitive dynamic data. It offers built-in encryption, audit logging, and granular IAM permissions—perfect for managing per-user refresh tokens.

How to implement it: #

• Create a secret per user (e.g., refresh-token-user-123) and store the generated token as a secret version. Example code:

  const { SecretManagerServiceClient } = require('@google-cloud/secret-manager');
  const client = new SecretManagerServiceClient();
  const projectId = process.env.GCP_PROJECT;
  
  async function storeRefreshToken(userId, token) {
    const secretId = `refresh-token-${userId}`;
    const parent = `projects/${projectId}`;
  
    // Create the secret if it doesn't exist
    try {
      await client.createSecret({
        parent,
        secretId,
        secret: { replication: { automatic: {} } }
      });
    } catch (err) {
      // Ignore "already exists" error
      if (err.code !== 6) throw err;
    }
  
    // Add the token as a new secret version
    await client.addSecretVersion({
      parent: `projects/${projectId}/secrets/${secretId}`,
      payload: { data: Buffer.from(token, 'utf8') }
    });
  }
  

• Assign the roles/secretmanager.secretAdmin role to your Functions’ service account to allow it to create and access secrets.

3. Encrypted Firebase Realtime Database #

If your project uses Realtime Database instead of Firestore, the same logic applies: encrypt tokens before storage and enforce strict security rules to limit access to only your Functions.

Example security rules: #

{
  "rules": {
    "refresh-tokens": {
      "$userId": {
        ".read": "auth != null && auth.token.email == 'your-project-id@appspot.gserviceaccount.com'",
        ".write": "auth != null && auth.token.email == 'your-project-id@appspot.gserviceaccount.com'"
      }
    }
  }
}

Key Security Best Practices #

• Follow the principle of least privilege: Only grant your Functions’ service account the exact permissions it needs (no over-assigning roles).
• Rotate encryption keys regularly: If using client-side encryption, update your environment variable key periodically.
• Avoid plaintext storage: Never store refresh tokens without encryption—even if the database has at-rest encryption, adding a client-side layer drastically reduces risk if there’s a breach.

内容的提问来源于stack exchange，提问作者not io