securityDefinitions:firebase:authorizationUrl:""flow:"implicit"type:"oauth2"# Replace YOUR-PROJECT-ID with your project IDx-google-issuer:"https://securetoken.google.com/YOUR-PROJECT-ID"x-google-jwks_uri:"https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com"x-google-audiences:"YOUR-PROJECT-ID"
security セクションを追加します。API 全体に適用する場合は API レベルに、特定のメソッドに適用する場合はメソッドレベルに追加します。
security:
- firebase: []
OpenAPI ドキュメントでは複数のセキュリティ定義を記述できますが、定義ごとに異なる issuer が必要です。security セクションを API レベルとメソッド レベルの両方で指定した場合、API レベルの設定よりもメソッド レベルの設定が優先されます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-03-25 UTC。"],[[["\u003cp\u003eCloud Endpoints uses JSON Web Tokens (JWT) for user authentication, validated by the Extensible Service Proxy (ESP) without requiring additional code in your API.\u003c/p\u003e\n"],["\u003cp\u003eThe client application must include specific JWT claims (iss, sub, aud, iat, exp) in the authorization header of HTTP requests for successful authentication.\u003c/p\u003e\n"],["\u003cp\u003eOpenAPI documents need security requirement and definition objects for ESP to validate JWT claims, such as using Firebase authentication with the necessary security settings and project ID.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication tokens can be sent in the \u003ccode\u003eAuthorization:Bearer\u003c/code\u003e header, or alternatively as an \u003ccode\u003eaccess_token\u003c/code\u003e query parameter, for making calls to an Endpoints API.\u003c/p\u003e\n"],["\u003cp\u003eESP forwards the authentication results to the backend API in the \u003ccode\u003eX-Endpoint-API-UserInfo\u003c/code\u003e header, which is a base64url-encoded JSON object containing the JWT payload and is the recommended way of accessing the authentication results.\u003c/p\u003e\n"]]],[],null,["# Using Firebase to authenticate users\n\nOpenAPI \\| gRPC\n\n\u003cbr /\u003e\n\nThis page describes how to support user authentication in Cloud Endpoints.\n\nTo authenticate a user, a client application must send a\n[JSON Web Token (JWT)](https://jwt.io/) in the authorization header of the\nHTTP request to your backend API. The\n[Extensible Service Proxy (ESP)](/endpoints/docs/glossary#extensible_service_proxy)\nvalidates the token on behalf of your API, so you don't have to add any code in\nyour API to process the authentication. However, you do need to configure your\nOpenAPI document to support your chosen authentication methods.\n\nESP validates a JWT in a performant way by using the JWT's\nissuer's public keys. ESP caches the public keys for five\nminutes. In addition, ESP caches validated JWTs for five minutes\nor until JWT expiry, whichever happens first.\n\nBefore you begin\n----------------\n\n- Add authentication code to your client application, following the [Firebase authentication](https://firebase.google.com/docs/auth/), documentation. Firebase supports authentication by using passwords, phone numbers, and popular federated identity providers like Google, Facebook and Twitter.\n\n\n- When your client application sends an HTTP request, the authorization header in the request must contain the following JWT claims:\n - `iss` (issuer)\n - `sub` (subject)\n - `aud` (audience)\n - `iat` (issued at)\n - `exp` (expiration time)\n\n\u003cbr /\u003e\n\nConfiguring your OpenAPI document\n---------------------------------\n\n\nYou must have a [security\nrequirement object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityRequirementObject) and a [security\ndefinitions object](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityDefinitionsObject) in your OpenAPI document for ESP to\nvalidate the claims in the signed JWT.\n\n\u003cbr /\u003e\n\nTo support Firebase authentication:\n\n1. Add the following to the security definition in your OpenAPI\n document:\n\n securityDefinitions:\n firebase:\n authorizationUrl: \"\"\n flow: \"implicit\"\n type: \"oauth2\"\n # Replace YOUR-PROJECT-ID with your project ID\n x-google-issuer: \"https://securetoken.google.com/YOUR-PROJECT-ID\"\n x-google-jwks_uri: \"https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com\"\n x-google-audiences: \"YOUR-PROJECT-ID\"\n\n | **Note:** When defining security schemes in your OpenAPI document for JWT authentication, you must include the `authorizationUrl` field, even if its value is an empty string (\"\"). This is a requirement of the OpenAPI specification. Although the field is mandatory for the spec, its value is not used by Cloud Endpoints or API Gateway when validating a JWT.\n2. Add a security section at either the API level to apply to the entire\n API, or at the method level to apply to a specific method.\n\n security:\n - firebase: []\n\n\nYou can define multiple security definitions in the OpenAPI document, but each\ndefinition must have a different issuer. If you use security sections at both\nthe API level and at the method level, the method-level settings override the\nAPI-level settings.\n\n\u003cbr /\u003e\n\n\nYou may also customize JWT locations by adding `x-google-extensions`. For details, see [openAPI extensions](/endpoints/docs/openapi/openapi-extensions#x-google-jwt-locations).\n\n\u003cbr /\u003e\n\nMaking an authenticated call to an Endpoints API\n------------------------------------------------\n\nWhen you send a request using an authentication token, for security reasons, we\nrecommend that you put the token in the `Authorization:Bearer` header. For\nexample: \n\n curl -H \"Authorization: Bearer ${TOKEN}\" \"${ENDPOINTS_HOST}/echo\"\n\nHere, `ENDPOINTS_HOST` and `TOKEN` are environment variables containing your\nAPI host name and authentication token, respectively. See\n[Making an authenticated request to an Endpoints API](/endpoints/docs/openapi/service-account-authentication#making_an_authenticated_request).\nfor sample code that sends a request using the `Authorization:Bearer` header.\n\nIf you cannot use the header when sending the request, you can put the\nauthentication token in a query parameter called `access_token`. For example: \n\n curl \"${ENDPOINTS_HOST}/echo?access_token=${TOKEN}\"\n\nReceiving authenticated results in your API\n-------------------------------------------\n\n\nESP usually forwards all headers it receives. However, it overrides the\noriginal `Authorization` header when the backend address is specified by\n`x-google-backend` in OpenAPI specification or `BackendRule`\nin gRPC service configuration.\n\n\nESP will send the authentication result in the `X-Endpoint-API-UserInfo`\nto the backend API. We recommend using this header instead of the original\n`Authorization` header. This header is a string that `base64url` encodes\na JSON object. The JSON object format differs between ESPv2 and ESP.\nFor ESPv2, the JSON object is exactly the original JWT payload. For ESP,\nthe JSON object uses different field names and put original JWT payload under `claims` field.\nSee [Handle JWTs in the backend service](/endpoints/docs/openapi/migrate-to-esp-v2#handle-jwt)\nfor more information on the format.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n\n- [Troubleshooting JWT validation](/endpoints/docs/openapi/troubleshoot-jwt)\n- [Authentication between services](/endpoints/docs/openapi/service-account-authentication)\n\n\u003cbr /\u003e"]]
