firebase-admin-python: Could not verify token signature.

I had an epiphany just now.

When running Flutter from Android Studio, there is a hard limit on the number of characters that will be printed to stdout, with no indication that a truncation has occurred (as you can see the token doesn’t end on … or something to indicate that are characters omitted). When I get the full token it’s all working as expected.

I can’t believe how many hours of debugging I’ve spent on this… only to realize that there is no problem at all.

As a rule of thumb: don’t rely on flutter print statements.

I guess this issue is not meant to at all be part of this repository. Thanks for your help regardless guys!

Hey guys, we could get the complete token string by using log() method.

In my case, debugPrint(idToken) can only print 1014 characters of my token string. log(idToken) print 1146 characters which is a complete token string.

I must say that the problem is indeed unusual, but I think its no coincidence that I get an error at the exact same line as @hrqnogueira in the pkcs1.py.

I tried verifying the token with the Java Firebase admin SDK where it gave the same error ‘Could not verify signature’. Does that mean that I’ve somehow failed to properly setup Firebase on both the client and server apps? Let me walk through a detailed description of the project setup:

Firstly on the mobile app, users log in with google sign-in:

final GoogleSignInAccount googleUser = await _googleSignIn.signIn();
final GoogleSignInAuthentication googleAuth = await googleUser.authentication;
final AuthCredential credential = GoogleAuthProvider.getCredential(
  accessToken: googleAuth.accessToken,
  idToken: googleAuth.idToken,
);
await _firebaseAuth.signInWithCredential(credential);

Then I get Firebase ID tokens like this:

FirebaseUser user = await _firebaseAuth.currentUser();
IdTokenResult token = await user.getIdToken();
print(token.token);

The mobile app is linked to Firebase following Google’s instructions from here https://firebase.google.com/docs/flutter/setup I think that users appearing on the Firebase console as I log them in from the app is a confirmation that the setup is done properly?

Then, for the backend, I have downloaded a service account private key .json file and i use it to initialize the app:

import firebase_admin
from firebase_admin import credentials
import os

cred = credentials.Certificate(os.path.join(os.path.dirname(os.path.abspath(__file__)), "firebase_credentials.json"))
firebase_admin.initialize_app(cred)

Then i try to verify the ID token which i get from Flutter like so:

from firebase_admin import auth

token = "... token from Flutter print() here"
decoded_token = auth.verify_id_token(token)

At this point I get an error:

To dig deeper into the error I will put 2 breakpoints:

• google.auth.jwt line 235
• rsa.pkcs1.py line 417

Note, how at the first breakpoint, the token’s payload is indeed successfully decoded:

At the second breakpoint it tries to match the clearsig with MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and after nothing matches, it throws an error which cascades back to the auth.verify_id_token(token) method call

You guys just saved from a heart attack. I spent my whole day trying to figure out the cause and truncation was the issue. Thanks guys.

As I said, it is always due to truncation. Glad you figured it out.

Same here, I checked the token and it has an invalid signature. If this is a one off and there is no reliable way to replicate it, then I would close this.

Most of the issues we’ve seen before have been due to some truncation.

Im obtaining it from the flutter client app like so:

FirebaseUser user = await _firebaseAuth.currentUser();
IdTokenResult token = await user.getIdToken();
print(token.token);

I made sure its not truncated. The fireabase user is the result of signing in with Google Sign In.

I am experiencing the exact same problem, except my flutter app authenticates users with Google sign in rather than Facebook. Any suggestions?