苹果公司正在抱怨我的应用程序，因为我没有调用REST终端点revoke token来删除帐户。 我必须按照此文档中所述执行操作：https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens
为了调用此操作，我需要获取client_id、client_secret和token。 我的应用程序中的登录流程由Firebase管理，当用户执行登录时，我不会保存这些信息。 因此，我需要从iOS上的Firebase auth中恢复这3个参数，以便调用revoke token终端点。
在Firebase auth API on IOS中可能有一种方法可以为我调用Apple终端点revoke_token，但我没有找到它。
本文将介绍如何在Firebase环境中撤销使用“苹果登录”方式登录的Token。
根据苹果审核指南，未在2022年6月30日之前采取行动的应用可能会被删除。
翻译人员为本文编写了翻译稿，如果您对这些句子感到奇怪或描述不准确，请原谅。
本文使用Firebase的Functions，如果Firebase将来提供相关函数，我建议使用它。
整个过程如下所示。
您可以在 https://appleid.apple.com/auth/token 获取刷新令牌，并在 https://appleid.apple.com/auth/revoke 撤销令牌。
如果您已经使用Firebase实现了“苹果登录”，则应该在项目中某个位置有ASAuthorizationAppleIDCredential。
在我的情况下，它写成以下形式。
func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
if let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
guard let nonce = currentNonce else {
fatalError("Invalid state: A login callback was received, but no login request was sent.")
}
guard let appleIDToken = appleIDCredential.identityToken else {
print("Unable to fetch identity token")
return
}
guard let idTokenString = String(data: appleIDToken, encoding: .utf8) else {
print("Unable to serialize token string from data: \(appleIDToken.debugDescription)")
return
}
// Initialize a Firebase credential.
let credential = OAuthProvider.credential(withProviderID: "apple.com",
IDToken: idTokenString,
rawNonce: nonce)
// Sign in with Firebase.
Auth.auth().signIn(with: credential) { (authResult, error) in
if error {
// Error. If error.code == .MissingOrInvalidNonce, make sure
// you're sending the SHA256-hashed nonce as a hex string with
// your request to Apple.
print(error.localizedDescription)
return
}
// User is signed in to Firebase with Apple.
// ...
}
}
}
...
guard let idTokenString = String(data: appleIDToken, encoding: .utf8) else {
print("Unable to serialize token string from data: \(appleIDToken.debugDescription)")
return
}
// Add new code below
if let authorizationCode = appleIDCredential.authorizationCode,
let codeString = String(data: authorizationCode, encoding: .utf8) {
print(codeString)
}
...
function makeJWT() {
const jwt = require('jsonwebtoken')
const fs = require('fs')
// Path to download key file from developer.apple.com/account/resources/authkeys/list
let privateKey = fs.readFileSync('AuthKey_XXXXXXXXXX.p8');
//Sign with your team ID and key ID information.
let token = jwt.sign({
iss: 'YOUR TEAM ID',
iat: Math.floor(Date.now() / 1000),
exp: Math.floor(Date.now() / 1000) + 120,
aud: 'https://appleid.apple.com',
sub: 'YOUR CLIENT ID'
}, privateKey, {
algorithm: 'ES256',
header: {
alg: 'ES256',
kid: 'YOUR KEY ID',
} });
return token;
}
上述函数是通过使用您的密钥信息创建JWT而返回的。
现在，让我们使用AuthorizationCode获取Refresh Token。
我们将向函数添加名为getRefreshToken的函数。
exports.getRefreshToken = functions.https.onRequest(async (request, response) => {
//import the module to use
const axios = require('axios');
const qs = require('qs')
const code = request.query.code;
const client_secret = makeJWT();
let data = {
'code': code,
'client_id': 'YOUR CLIENT ID',
'client_secret': client_secret,
'grant_type': 'authorization_code'
}
return axios.post(`https://appleid.apple.com/auth/token`, qs.stringify(data), {
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
})
.then(async res => {
const refresh_token = res.data.refresh_token;
response.send(refresh_token);
});
});
exports.revokeToken = functions.https.onRequest( async (request, response) => {
//import the module to use
const axios = require('axios');
const qs = require('qs');
const refresh_token = request.query.refresh_token;
const client_secret = makeJWT();
let data = {
'token': refresh_token,
'client_id': 'YOUR CLIENT ID',
'client_secret': client_secret,
'token_type_hint': 'refresh_token'
};
return axios.post(`https://appleid.apple.com/auth/revoke`, qs.stringify(data), {
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
})
.then(async res => {
console.log(res.data);
});
});
以上函数基于我们获取的refresh_token撤销登录信息。
到目前为止，我们已经配置好了我们的函数。当我们执行“firebase deploy functions”时，我们将在Firebase函数控制台中添加一些内容。
现在回到Xcode。
在之前编写用于保存Refresh token的代码中调用Functions地址。
我将其保存在UserDefaults中，您也可以将其保存在Firebase数据库中。
...
// Add new code below
if let authorizationCode = appleIDCredential.authorizationCode, let codeString = String(data: authorizationCode, encoding: .utf8) {
let url = URL(string: "https://YOUR-URL.cloudfunctions.net/getRefreshToken?code=\(codeString)".addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) ?? "https://apple.com")!
let task = URLSession.shared.dataTask(with: url) {(data, response, error) in
if let data = data {
let refreshToken = String(data: data, encoding: .utf8) ?? ""
print(refreshToken)
UserDefaults.standard.set(refreshToken, forKey: "refreshToken")
UserDefaults.standard.synchronize()
}
}
task.resume()
}
...
在此时，当用户登录时，其设备将把refresh_token保存为UserDefaults。现在剩下的就是在用户离开服务时撤销。
func removeAccount() {
let token = UserDefaults.standard.string(forKey: "refreshToken")
if let token = token {
let url = URL(string: "https://YOUR-URL.cloudfunctions.net/revokeToken?refresh_token=\(token)".addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) ?? "https://apple.com")!
let task = URLSession.shared.dataTask(with: url) {(data, response, error) in
guard data != nil else { return }
}
task.resume()
}
...
//Delete other information from the database...
FirebaseAuthentication.shared.signOut()
}
auth/token的访问令牌成功地创建了撤销令牌API。详细信息请参见https://dev59.com/TcTra4cB1Zd3GeqP_pSJ#72656409。 - zangw我认为这应该从后端完成，以避免将敏感数据（client_secret）暴露给应用程序。以下是我在 .net 中生成 client_secret 并调用撤销令牌 API 端点的方法：
public static class EndUserUtils
{
//-------------------------- Apple JWT --------------------------
//Must add System.IdentityModel.Tokens.Jwt from NUGet
using System.Security.Claims;
using System.Security.Cryptography;
public static string GetAppleJWTToken(IErrorLogService errorLogService)
{
var dsa = GetECDsa(errorLogService);
return dsa != null ? CreateJwt(dsa, "KEY_ID", "TEAM_ID") : null; //Get KEY_ID and TEAM_ID from Apple developer site
}
private static ECDsa GetECDsa(IErrorLogService errorLogService)
{
try
{
var keyPath = Path.Combine("..", "Settings", "Keys", "AuthKey_KEY_ID.p8"); //Download from apple developer
using (TextReader reader = System.IO.File.OpenText(keyPath))
{
var privateKey = reader.ReadToEnd();
privateKey = privateKey
.Replace("-----BEGIN PRIVATE KEY-----", "")
.Replace("-----END PRIVATE KEY-----", "")
.Replace("\n", "");
var ecdsa = ECDsa.Create();
ecdsa?.ImportPkcs8PrivateKey(Convert.FromBase64String(privateKey), out _);
return ecdsa;
}
}
catch (Exception ex)
{
errorLogService?.AddException(ex);
}
return null;
}
private static string CreateJwt(ECDsa key, string keyId, string teamId)
{
var securityKey = new ECDsaSecurityKey(key) { KeyId = keyId };
var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.EcdsaSha256);
var descriptor = new SecurityTokenDescriptor
{
IssuedAt = DateTime.UtcNow,
Issuer = teamId,
SigningCredentials = credentials,
Expires = DateTime.UtcNow.AddMinutes(5), //Define how long generated JWT will be valid
Audience = "https://appleid.apple.com",
Subject = new ClaimsIdentity(new[]
{
new Claim("sub", "com.example.appname") //APP_ID
})
};
var handler = new JwtSecurityTokenHandler();
var encodedToken = handler.CreateEncodedJwt(descriptor);
return encodedToken;
}
}
从 .net core 后端调用苹果的 '撤销' 令牌终点
//Only for SignIn with Apple
if (!string.IsNullOrEmpty(tokenToRevoke))
{
var secret = EndUserUtils.GetAppleJWTToken(_errorLogService);
if (secret != null)
{
var formData = new List<KeyValuePair<string, string>>();
formData.Add(new KeyValuePair<string, string>("client_id", "com.example.appname"));
formData.Add(new KeyValuePair<string, string>("client_secret", secret));
formData.Add(new KeyValuePair<string, string>("token", tokenToRevoke));
formData.Add(new KeyValuePair<string, string>("token_type_hint", "access_token"));
var request = new HttpRequestMessage(HttpMethod.Post, "https://appleid.apple.com/auth/revoke")
{
Content = new FormUrlEncodedContent(formData)
};
using (var client = _httpClientFactory.CreateClient())
{
var result = client.SendAsync(request).GetAwaiter().GetResult();
if (!result.IsSuccessStatusCode)
{
_errorLogService.AddError($"Error revoking Apple idToken: {result.StatusCode}, {result.Content}");
//return error to application
}
}
}
}