# Integrate Firebase Authentication with Slim

**URL:** <https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968>\
**Category:** Questions\
**Created:** [March 26, 2020, 4:32pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968 "2020-03-26T16:32:06Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [March 26, 2020, 4:32pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/1 "2020-03-26T16:32:06Z")

</div>

Hi all, I am working on a new project which use Firebase and would I would like to integrate it with my Slim REST API. I cloned a Slim 4 skeleton add it my code in the middleware then when I make my calls with X-Authorization Bearer but get the following error:

slim.WARNING: OpenSSL error: error:0906D06C:PEM routines:PEM\_read\_bio:no start line [“eyJhbGciOiJSUzI1NiIsIm…”]

“description”: "ERROR: openssl\_verify(): supplied key param cannot be coerced into a public key on line 243 in file.

Any ideas what might be wrong? the secret and token used are checked in a simple php file and are valid.

This is my middleware.php

```
<?php

declare(strict_types=1);

use Psr\Http\Message\ServerRequestInterface as Request;

use Psr\Http\Server\RequestHandlerInterface as RequestHandler;

use Slim\Psr7\Response;

use App\Application\Middleware\SessionMiddleware;

use App\Application\Middleware\CorsMiddleware;

use Slim\App;

//Extra for auth

use Tuupola\Middleware\HttpBasicAuthentication;

use \Firebase\JWT\JWT;

use Monolog\Logger;

use Monolog\Handler\RotatingFileHandler;

return function (App $app) {

    $app->add(CorsMiddleware::class);

    $container = $app->getContainer();

    

    $rawPublicKeys = file_get_contents('https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com');

    $keys = json_decode($rawPublicKeys, true);

    $keyKidsArray= array_keys($keys);

    $pKeysArray = array_values($keys);

    $secrets = $keyKidsArray[0] . ':' . $pKeysArray[0] . ',' . $keyKidsArray[1] . ':' . $pKeysArray[1];

    $logger = new Logger("slim");

    $rotating = new RotatingFileHandler( __DIR__. "/logs/slim.log", 0, Logger::DEBUG);

    $logger->pushHandler($rotating);

    echo $secrets;

    

    $app->add(new Tuupola\Middleware\JwtAuthentication([

        "ignore" => ["/api/records/countries","/faqs"],

        "algorithm" => ["RS256"],

        "header" => "X-Authorization",

        "regexp" => "/Bearer\s+(.*)$/i",

        "logger" => $logger,

        "secret" => $secrets,

        "secure" => false,

        "error" => function ($response, $arguments) {

            $data["status"] = "error";

            $data["message"] = $arguments["message"];

            return $response

                ->withHeader("Content-Type", "application/json")

                ->getBody()->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));

        }

        

    ]));

    

};
```

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [March 26, 2020, 8:28pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/2 "2020-03-26T20:28:46Z")

</div>

Hi @leossmith

What are you trying to achieve by downloading the public keys for each API request from the Google server?

According to Tuupola’s documentation, the `secret` is just a fixed string.

> For simplicity’s sake examples show `secret` hardcoded in code. In real life you should store it somewhere else. Good option is environment variable. You can use [dotenv](https://github.com/vlucas/phpdotenv) or something similar for development. Examples assume you are using Slim Framework.

```php
$app->add(new \Tuupola\Middleware\JwtAuthentication([
    "secret" => "supersecretkeyyoushouldnotcommittogithub"
]));

```

> slim.WARNING: OpenSSL error: error:0906D06C:PEM routines:PEM\_read\_bio:no start line

AFAIK, the Tuupola JwtAuthentication doesn’t use OpenSSL or anyting similar.

---

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [March 27, 2020, 10:32am UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/3 "2020-03-27T10:32:54Z")

</div>

Hi Odan,

using the secrets from Google server for firebase, you can use the firebase authentication generated JWT and validate it in your server. So the user flow is: Users login with firebase, gets token, make a request to my slim api (get pois with X-Authorization Bearer TOKEN\_FROM\_FIREBASE), midleware checks token against keys and authorizes user in my API.

Although I have managed to get it working with other systems (check for example [this](https://github.com/mevdschee/php-crud-api#configure-and-test-jwt-authentication-with-firebase) ), it looks like the issue here is Firebase/php-jwt, which is used by Tuupola JwtAuthentication and not processing the keys as should.

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [March 27, 2020, 10:45am UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/4 "2020-03-27T10:45:24Z")

</div>

I think, in your special use case, Tuupola\JwtAuthentication is not the right “tool” you are looking for because it doesn’t support public keys etc.

---

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [March 27, 2020, 10:50am UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/5 "2020-03-27T10:50:47Z")

</div>

Can you suggest another lib or even another way to approach this?

EDIT:  
Working further with it, i am now 100% that Tuupola\JwtAuthentication is not the issue. Editing line 243 in Firebase/php-jwt/JWT.php (//$success = openssl\_verify($msg, $signature, $key, $algorithm); ) allows the system to authenticate correctly and get the expected behavior.

---

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [March 27, 2020, 2:12pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/6 "2020-03-27T14:12:56Z")

</div>

Ok so after further work with it, it looks like the firebase/php-jwt does all the job of splitting the keys to KID, secret etc internally and I didnt have to provide them on my own. After passing the $keys as a secret for the middleware, everything worked as should.

---

<div class="post-metadata">

**Author:** ![gregorispielmann](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gregorispielmann](https://discourse.slimframework.com/u/gregorispielmann)\
**Post date:** [April 9, 2020, 4:23pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/7 "2020-04-09T16:23:22Z")

</div>

@leossmith did you get how to make this work? I’m in the same case of yours and don’t know how to make this work.

---

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [April 22, 2020, 5:13pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/8 "2020-04-22T17:13:25Z")

</div>

@gregorispielmann Yes I made it work. This is my midleware:

```
return function (App $app) {
$app->add(CorsMiddleware::class);

$container = $app->getContainer();

$rawPublicKeys = file_get_contents('https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com');
$keys = json_decode($rawPublicKeys, true);

$logger = new Logger("slim");
$rotating = new RotatingFileHandler( __DIR__. "/logs/slim.log", 0, Logger::DEBUG);
$logger->pushHandler($rotating);

$app->add(new Tuupola\Middleware\JwtAuthentication([
    "ignore" => ["/api/records/countries","/faqs"],
    "algorithm" => ["RS256"],
    "header" => "X-Authorization",
    "regexp" => "/Bearer\s+(.*)$/i",
    "logger" => $logger,
    "secret" => $keys,
    "secure" => false,
    "error" => function ($response, $arguments) {
        $data["status"] = "error";
        $data["message"] = $arguments["message"];
        return $response
            ->withHeader("Content-Type", "application/json")
            ->getBody()->write(json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT));
    }
]));

```

};

---

<div class="post-metadata">

**Author:** ![gregorispielmann](https://avatars.discourse-cdn.com/v4/letter/g/ac91a4/32.png) [@gregorispielmann](https://discourse.slimframework.com/u/gregorispielmann)\
**Post date:** [April 22, 2020, 8:09pm UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/9 "2020-04-22T20:09:41Z")

</div>

@leossmith thank you! You’ve helped me a lot at github too.

Thanks again!

---

<div class="post-metadata">

**Author:** ![leossmith](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/leossmith/32/1109_2.png) [@leossmith](https://discourse.slimframework.com/u/leossmith)\
**Post date:** [April 23, 2020, 10:39am UTC](https://discourse.slimframework.com/t/integrate-firebase-authentication-with-slim/3968/10 "2020-04-23T10:39:03Z")

</div>

> [@gregorispielmann](#):
>
> ve helped me a lot at github too.
> 
> Thanks again!

Happy to help 🙂 This might be a good thing to add in documentation as it looks both Firebase Auth and Auth0 are used a lot these days.