Google Cloud Run+API Gateway+Firebase认证报错求助

1. 修正OpenAPI配置中的CORS与认证规则 #

首先检查你的OpenAPI配置文件，核心要确保OPTIONS预请求跳过Firebase认证，同时正确配置CORS响应头：

swagger: '2.0'
info:
  title: Your Service API
  version: '1.0'
schemes:
  - https
produces:
  - application/json

x-google-backend:
  address: https://your-cloud-run-service-url.a.run.app
  path_translation: APPEND_PATH_TO_ADDRESS

securityDefinitions:
  firebase_auth:
    type: "oauth2"
    authorizationUrl: ""
    flow: "implicit"
    x-google-audiences: "your-firebase-project-id"
    x-google-issuer: "https://securetoken.google.com/your-firebase-project-id"
    x-google-jwks_uri: "https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com"

security:
  - firebase_auth: []

paths:
  "/{proxy+}":
    # 单独处理OPTIONS预请求，跳过认证
    options:
      summary: Handle CORS preflight
      x-google-backend:
        address: https://your-cloud-run-service-url.a.run.app
        path_translation: APPEND_PATH_TO_ADDRESS
      responses:
        '200':
          description: OK
          headers:
            Access-Control-Allow-Origin:
              type: string
            Access-Control-Allow-Methods:
              type: string
            Access-Control-Allow-Headers:
              type: string
          schema:
            type: object
      x-google-security: {} # 关键：禁用该请求的认证要求

    # 其他业务请求保持认证规则
    get:
      summary: Your GET endpoint
      responses:
        '200':
          description: Success response

关键要点：

• 给/{proxy+}的OPTIONS方法添加x-google-security: {}，让浏览器预请求无需携带Token即可通过
• CORS响应头必须包含Authorization（在Access-Control-Allow-Headers中），确保后续业务请求能携带Token

2. 彻底清理并重新部署API Gateway #

之前的残留配置可能导致问题，按以下步骤彻底重建：

• 删除旧部署与API：

  gcloud api-gateway deployments delete DEPLOYMENT_NAME --api=API_NAME --project=YOUR_PROJECT_ID
  gcloud api-gateway apis delete API_NAME --project=YOUR_PROJECT_ID
  

• 等待1-2分钟确保资源完全释放，再重新创建：

  # 创建API
  gcloud api-gateway apis create YOUR_API_NAME --project=YOUR_PROJECT_ID
  # 创建配置（指定有权访问Cloud Run的服务账号）
  gcloud api-gateway api-configs create YOUR_CONFIG_NAME --api=YOUR_API_NAME --openapi-spec=openapi.yaml --project=YOUR_PROJECT_ID --backend-auth-service-account=YOUR_SERVICE_ACCOUNT@YOUR_PROJECT_ID.iam.gserviceaccount.com
  # 部署网关
  gcloud api-gateway deployments create YOUR_DEPLOYMENT_NAME --api=YOUR_API_NAME --api-config=YOUR_CONFIG_NAME --project=YOUR_PROJECT_ID --region=us-central1
  

• 确认服务账号已拥有roles/run.invoker权限，能访问目标Cloud Run服务

3. 验证前端Firebase Token的正确性 #

确保前端请求携带的是ID Token而非Access Token：

// 前端获取有效ID Token的示例代码
firebase.auth().currentUser.getIdToken(true)
  .then(idToken => {
    fetch('https://your-api-gateway-url', {
      headers: { 'Authorization': `Bearer ${idToken}` }
    });
  });

• 用命令行验证Token有效性：

  curl https://oauth2.googleapis.com/tokeninfo?id_token=YOUR_ID_TOKEN
  

  确认返回结果中aud为你的Firebase项目ID，iss为https://securetoken.google.com/your-project-id

4. 检查Cloud Run的访问控制 #

• 将Cloud Run服务的访问权限设置为「允许内部流量和Cloud Load Balancing」（生产环境推荐），或临时设置为「允许所有用户」排查问题
• 查看Cloud Run日志，确认请求是否到达服务，以及是否存在认证相关的错误信息

内容的提问来源于stack exchange，提问作者Nick Carducci for Carface Bank