feat!(google-auth): require 'audience' in verify_firebase_token()
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 57/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- python
- Domain
- authentication
Research direction
Read google.oauth2.id_token.verify_firebase_token() and its async counterpart in google.oauth2._id_token_async, then inspect their tests and the warning added in #18777. Make audience required in both APIs and verify that the Firebase token's aud claim is checked; done when both implementations and their tests reflect the required project ID.
Written by the indexing model from the issue text.
Description
Currently, google.oauth2.id_token.verify_firebase_token() (and its async counterpart in google.oauth2._id_token_async) defaults audience=None, leaving the token's aud claim unverified and emitting a UserWarning (added in #18777).
In the next major release of google-auth (3.0.0), audience (the target Firebase project ID) should be required so that verify_firebase_token() always verifies the aud claim per the Firebase ID token verification specification.
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1.8k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 173
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-cloud-python
-
firestore: field path with a quoted name ending in a backslash is misparsedPossibly taken @sebxt claimed this 25 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/google-cloud-python#18771 ·
Maintainers usually reply within 1 day
-
api: spanner type: feature request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
googleapis/google-cloud-python#18584 ·
Maintainers usually reply within 1 day
-
auth: `impersonated_credentials` loses `subject` on copy, so `with_scopes()` and `with_quota_project()` turn off domain wide delegationPossibly taken @Om-singhaI claimed this 55 days ago. Openauth priority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
googleapis/google-cloud-python#18428 ·
Maintainers usually reply within 1 day
-
A client called `run_in_transaction` be stuck if Spanner is downPossibly taken @founderinaction claimed this 7 days ago. Openpriority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/google-cloud-python#18375 · 1 comment ·
Maintainers usually reply within 1 day
-
ci: enable --strict flag in presubmit twine_checkMay be free again @ohmayr claimed this 44 days ago, and no pull request is open. Open
Difficulty 1/5 Under an hour Newbie friendliness 76/100
googleapis/google-cloud-python#18339 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
All issues in googleapis/google-cloud-python
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
cpp-best-practices/project_validator#267 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Project-N-E-K-O/N.E.K.O#3725 ·
Maintainers usually reply within 1 day
-
[Bug] Sending a Telegram message chain twice duplicates mentionsPossibly taken @123XieC claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AstrBotDevs/AstrBot#11125 ·
Maintainers usually reply within 1 day
-
backend bug priority: high
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nooriegarg/ContribIQ#73 ·
Maintainers usually reply within 1 day
-
bug p3 security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day