Validate onRequest with oidcToken from cloud task

[dpelkey98]

Like the title suggests. I am creating cloud tasks and linking an oidcToken service account email. They are configured to call a Firebase onRequest function, but I do not know how to validate the token from the request. Nor can I find resources explaining how to.

Thanks, Dalton

[lawrencenelson]

Hi @dpelkey98,

I believe @ John Hanley has answered a similar question in Stack Overflow:

Firebase Function is Cloud Functions. The steps to verify an OIDC identity token are the same running inside the cloud or outside. A service account is not required to verify as RSA public keys are used. Notes: 1) How are you getting the ID token (HTTP Authorization header)? Google IAP removes the signature to prevent token replay. IAP also validates the token for you. If your goal is to extract details from the token, the format is published: base64 header + base64 payload + base64 signature. The payload is JSON and has the identity details.