php - Firebase .on not working with authentication -

update

i able @ least client side code work authentication using firebase-simple-login.js , auth.login('anonymous'). server side (ie "write") still not work.

original question

i creating app firebase integration , need secure firebase data. being able delete if know firebase url , without authentication less ideal.

i not trying log users in (or @ least not in traditional sense), want make sure there sort of authentication going on when read , write firebase data. have spent hours on , cannot seem make work (so "easy").

first, firebase security rules - simple

{     "rules": {       ".read" : "auth != null",       ".write": "auth != null"     } } 

i pushing firebase server side code , reading results client side. simple polling app - poll responses pushed firebase in following format: clients\clienta\polls\pollid(random)\randomdataid(from firebase)\response data. using firebase/php-jwt generate server side jwt:

    <?php  class generatefirebasetoken {     public static function generate(array $data = array())     {         $key = 'firebase secret key';         $token = array(             'iss' => 'https://example.com',             'iat' => time()         );         // add additional data token         $token = array_merge($token, $data);         $jwt = jwt::encode($token, $key);          return $jwt;     } } 

i pushing data firebase following code. there several variables user's session included. uses class wrote prepares curl request firebase. works fine if remove auth != null firebase rules. otherwise, nothin':

$fbdata = array(             'name' => "{$this->user->first_name} {$this->user->last_name}",             'answer' => $fbanswer,             'gravatar' => gravatar::src($this->user->email)         );         $token = generatefirebasetoken::generate();         $fb = new firebase("clients/{$this->client->nickname}/polls/{$poll->uniquid}.json?auth=$token", $fbdata);         $fb->execute('post'); 

source of $fb->execute()

public function execute($method)     {         $data_string = json_encode($this->data);          $ch = curl_init($this->root . $this->path); // http://myapp.firebaseio.com/         curl_setopt($ch, curlopt_customrequest, $method);         curl_setopt($ch, curlopt_postfields, $data_string);         curl_setopt($ch, curlopt_returntransfer, true);         curl_setopt($ch, curlopt_httpheader, array(                 'content-type: application/json',                 'content-length: ' . strlen($data_string))         );          $result = curl_exec($ch);         return $result;     } 

client side not work. retrieve jwt performing $.getjson request server side code , pass on firebase. seems authenticate correctly receive error firebase warning: on() or once() /clients/exampleclient/polls/fdv4rm9lhcob7u7w failed: error: permission_denied: client doesn't have permission access desired data.. here client side code:

    $.getjson('/secure/jwt-token', function(json) {         jwttoken = json.token;         launchfirebase(jwttoken);     }); function launchfirebase(token) {     var fb = new firebase('https://myapp.firebaseio.com/clients/exampleclient/polls/' + pollid);     fb.auth(token, function(e) {         if(e) {             alert('authentication error : ' + e);         } else {             alert('authenticated'); // alert shows, assume authenticated             fb.on('child_added', function(snapshot) {                 // stuff                 // error occurs here.             });         }     }); } 

i assuming missing simple here, perhaps not understand how use jwt.. whatever case, appreciated. thanks!

hours of wasted effort found problem, helps else new using firebase. goes show if you're working on same issue hours, take break , fog begin clear.

okay, problem -- of course -- simple. using firebase/php-jwt library. had right except fact did not add 'd' token data array - this auth comes from. so, security rules checking auth, missing because did not add d token.

here fixed code:

$key = 'your-security-key';         $token = array(             'iss' => 'https://example.com',             'iat' => time(),             'd' => array(                 'foo' => 'bar' // gives auth variable!!!!!             )         );         // add additional data token         $token = array_merge($token, $data);         $jwt = jwt::encode($token, $key);          return $jwt; 

if write code people plug service, in case, please provide better documentation. seems such things entirely omitted, perhaps because developer should know intrinsically? discovered answer reading docs making token without use of helper library (like one).