@@ -20,14 +20,15 @@ app.post('/sessionLogin', (req, res) => {
2020 // The session cookie will have the same claims as the ID token.
2121 // To only allow session cookie setting on recent sign-in, auth_time in ID token
2222 // can be checked to ensure user was recently signed in before creating a session cookie.
23- admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) . then ( ( sessionCookie ) => {
24- // Set cookie policy for session cookie.
25- const options = { maxAge : expiresIn , httpOnly : true , secure : true } ;
26- res . cookie ( 'session' , sessionCookie , options ) ;
27- res . end ( JSON . stringify ( { status : 'success' } ) ) ;
28- } , error => {
29- res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
30- } ) ;
23+ admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} )
24+ . then ( ( sessionCookie ) => {
25+ // Set cookie policy for session cookie.
26+ const options = { maxAge : expiresIn , httpOnly : true , secure : true } ;
27+ res . cookie ( 'session' , sessionCookie , options ) ;
28+ res . end ( JSON . stringify ( { status : 'success' } ) ) ;
29+ } , error => {
30+ res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
31+ } ) ;
3132} ) ;
3233// [END session_login]
3334
@@ -37,16 +38,17 @@ app.post('/verifyToken', (req, res) => {
3738 // Set session expiration to 5 days.
3839 const expiresIn = 60 * 60 * 24 * 5 * 1000 ;
3940 // [START check_auth_time]
40- admin . auth ( ) . verifyIdToken ( idToken ) . then ( ( decodedIdToken ) => {
41- // Only process if the user just signed in in the last 5 minutes.
42- if ( new Date ( ) . getTime ( ) / 1000 - decodedIdToken . auth_time < 5 * 60 ) {
43- // Create session cookie and set it.
44- return admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) ;
45- }
46- // A user that was not recently signed in is trying to set a session cookie.
47- // To guard against ID token theft, require re-authentication.
48- res . status ( 401 ) . send ( 'Recent sign in required!' ) ;
49- } ) ;
41+ admin . auth ( ) . verifyIdToken ( idToken )
42+ . then ( ( decodedIdToken ) => {
43+ // Only process if the user just signed in in the last 5 minutes.
44+ if ( new Date ( ) . getTime ( ) / 1000 - decodedIdToken . auth_time < 5 * 60 ) {
45+ // Create session cookie and set it.
46+ return admin . auth ( ) . createSessionCookie ( idToken , { expiresIn} ) ;
47+ }
48+ // A user that was not recently signed in is trying to set a session cookie.
49+ // To guard against ID token theft, require re-authentication.
50+ res . status ( 401 ) . send ( 'Recent sign in required!' ) ;
51+ } ) ;
5052 // [END check_auth_time]
5153} ) ;
5254
@@ -57,28 +59,32 @@ app.post('/profile', (req, res) => {
5759 // Verify the session cookie. In this case an additional check is added to detect
5860 // if the user's Firebase session was revoked, user deleted/disabled, etc.
5961 admin . auth ( ) . verifySessionCookie (
60- sessionCookie , true /** checkRevoked */ ) . then ( ( decodedClaims ) => {
61- serveContentForUser ( '/profile' , req , res , decodedClaims ) ;
62- } ) . catch ( error => {
63- // Session cookie is unavailable or invalid. Force user to login.
64- res . redirect ( '/login' ) ;
65- } ) ;
62+ sessionCookie , true /** checkRevoked */ )
63+ . then ( ( decodedClaims ) => {
64+ serveContentForUser ( '/profile' , req , res , decodedClaims ) ;
65+ } )
66+ . catch ( error => {
67+ // Session cookie is unavailable or invalid. Force user to login.
68+ res . redirect ( '/login' ) ;
69+ } ) ;
6670} ) ;
6771// [END session_verify]
6872
6973app . post ( '/verifySessionCookie' , ( req , res ) => {
7074 const sessionCookie = req . cookies . session || '' ;
7175 // [START session_verify_with_permission_check]
72- admin . auth ( ) . verifySessionCookie ( sessionCookie , true ) . then ( ( decodedClaims ) => {
73- // Check custom claims to confirm user is an admin.
74- if ( decodedClaims . admin === true ) {
75- return serveContentForAdmin ( '/admin' , req , res , decodedClaims ) ;
76- }
77- res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
78- } ) . catch ( error => {
79- // Session cookie is unavailable or invalid. Force user to login.
80- res . redirect ( '/login' ) ;
81- } ) ;
76+ admin . auth ( ) . verifySessionCookie ( sessionCookie , true )
77+ . then ( ( decodedClaims ) => {
78+ // Check custom claims to confirm user is an admin.
79+ if ( decodedClaims . admin === true ) {
80+ return serveContentForAdmin ( '/admin' , req , res , decodedClaims ) ;
81+ }
82+ res . status ( 401 ) . send ( 'UNAUTHORIZED REQUEST!' ) ;
83+ } )
84+ . catch ( error => {
85+ // Session cookie is unavailable or invalid. Force user to login.
86+ res . redirect ( '/login' ) ;
87+ } ) ;
8288 // [END session_verify_with_permission_check]
8389} ) ;
8490
@@ -94,13 +100,16 @@ app.post('/sessionLogout', (req, res) => {
94100app . post ( '/sessionLogout' , ( req , res ) => {
95101 const sessionCookie = req . cookies . session || '' ;
96102 res . clearCookie ( 'session' ) ;
97- admin . auth ( ) . verifySessionCookie ( sessionCookie ) . then ( ( decodedClaims ) => {
103+ admin . auth ( ) . verifySessionCookie ( sessionCookie )
104+ . then ( ( decodedClaims ) => {
98105 return admin . auth ( ) . revokeRefreshTokens ( decodedClaims . sub ) ;
99- } ) . then ( ( ) => {
100- res . redirect ( '/login' ) ;
101- } ) . catch ( ( error ) => {
106+ } )
107+ . then ( ( ) => {
102108 res . redirect ( '/login' ) ;
103- } ) ;
109+ } )
110+ . catch ( ( error ) => {
111+ res . redirect ( '/login' ) ;
112+ } ) ;
104113} ) ;
105114// [END session_clear_and_revoke]
106115
0 commit comments