Verify Firebase ID Token Using Fuel PHP

This is a simplistic approach to use a PHP Framework (Fuel PHP) instead of Plain PHP.

Frameworks often have better mechanisms to handle web requests. For example, you can easily create a RESTful server and test it using REST Client such as Postman (refer the above screenshot). Install Postman REST Client for Chrome here.

1) Create Fuel PHP Project and Add PHP-JWT Library to the project

If your hosting provider includes softaculous in their services, read this page to quickly create Fuel PHP Project on your web site, https://php-steps.blogspot.com/2018/10/install-fuelphp-via-softaculous.html .

2) Write the PHP script

filename: ./fuel/app/classes/controller/verifytoken.php

<?php header("Access-Control-Allow-Origin: *"); require 'phpjwt/JWT.php'; require 'phpjwt/SignatureInvalidException.php'; require 'phpjwt/ExpiredException.php'; use \Firebase\JWT\JWT; class Controller_VerifyToken extends Controller_Rest { // default format protected $format = 'json'; public function get_index() { $isVerified=false; $jwt=Input::get('token'); $tks = explode('.', $jwt); list($headb64, $bodyb64, $cryptob64) = $tks; try{ $header = \Firebase\JWT\JWT::jsonDecode(Firebase\JWT\JWT::urlsafeB64Decode($headb64)); $kid=$header->kid; }catch (Exception $e){ //die($e); $kid=""; } $strPublicKeys = file_get_contents("https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"); $jsonPublicKeys = json_decode($strPublicKeys, true); if(isset($jsonPublicKeys[$kid])){ $publicKey = $jsonPublicKeys[$kid]; try{ $decoded = JWT::decode($jwt, $publicKey, array('RS256')); }catch (\Exception $e){ // die($e); $decoded =""; } }else{ $decoded =""; } if($decoded!=""){ $isVerified=true; } return $this->response(array( 'content' => $isVerified, )); } }

If you do not want to use PHP Framework, read this page to create Plain PHP script codes, https://php-steps.blogspot.com/2018/05/verify-firebase-id-token-using-plain.html .