2

I am writing an App server application in C# that needs to access Firebase Database. It uses REST protocol. To authentication i want to use an service account.

Unfortunately there is no library written in C#, so i am trying to put the bellow http Request to work.

I follow this steps:

  1. To get the accesstoken i follow the https://github.com/google/google-api-dotnet-client-samples. The code prints the token so should be ok to that point.

  2. Invoke GET web request passing the token in the access_token query parameter as documented at https://firebase.google.com/docs/reference/rest/database/user-auth.

I tried all variations i could remember, in headers, with apostrophe, APN request style, but always got 401 error or 403. Error code 403 should mean that the API recognize the user but denys access to the resource, but i am not sure if this works this way in this case.

The account is defined in the API console and it has project edit and owner profile, for the Firebase app.

The rules are set like this:
{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

Can't figure out were i went wrong. I don't think i need to go written an JWT token if i use google API library. Rules should not apply to this account so i guess i am not passing the token correctly. By inspecting the token retrieved i can see that it is of type Bear, so i tried to pass it on header with no success too.

Test code:

using System;
using System.Security.Cryptography.X509Certificates;
using Google.Apis.Auth.OAuth2;
using System.Threading.Tasks;
using System.Net;
using System.IO;

namespace FirebaseAppServer
{

    /// </summary>
    public class Program
    {

        public static  void Main(string[] args)
        {
            accessFirebase();

            Console.WriteLine("Press any key to continue...");
            Console.ReadKey();
        }

        public async static Task accessFirebase()
        {
             String serviceAccountEmail = "serviceaccount1@myapp.iam.gserviceaccount.com";

            var certificate = new X509Certificate2(@"App.p12", "notasecret", X509KeyStorageFlags.Exportable); //App2 is the certificate i downloaded from API console

            ServiceAccountCredential credential = new ServiceAccountCredential(
               new ServiceAccountCredential.Initializer(serviceAccountEmail)
               { 
                   Scopes = new[] { "https://www.googleapis.com/auth/firebase.database" //from https://developers.google.com/identity/protocols/googlescopes
                                    ,"https://www.googleapis.com/auth/firebase"
                                    ,"https://www.googleapis.com/auth/cloud-platform"}
               }.FromCertificate(certificate));


            var task = await credential.RequestAccessTokenAsync(System.Threading.CancellationToken.None);

            Console.WriteLine("AccessToken " + credential.Token.AccessToken); //accessToken has a value, so guess is all good so far.

            var request = (HttpWebRequest)WebRequest.Create("https://<Myapp>.firebaseio.com/.json?access_token=" + credential.Token.AccessToken);
            request.Method = "GET";
            request.ContentType = "application/json";

            using (var response = (HttpWebResponse)request.GetResponse()) //Throw error 403 - forbidden
            {
                var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();
                Console.WriteLine("responseString " + responseString);
            }
        }
MiguelSlv
  • 14,067
  • 15
  • 102
  • 169
  • Have you found a solution? My question is here http://stackoverflow.com/questions/40810233 . I can't figure out why I get 403 Permission denied when I try to access Firebase DB via HTTP/REST . – bibscy Nov 26 '16 at 19:12
  • I switch to secret authentication. – MiguelSlv Nov 26 '16 at 20:18
  • The reason why you were getting Permission Denied, 403 Forbidden was because you didn't assign to `scope` the value `https://www.googleapis.com/auth/userinfo.email` . See my answer stackoverflow.com/questions/40810233 – bibscy Nov 27 '16 at 17:15

0 Answers0