FR: auth.verify_id_token should throw a more specific exception

[jvorcak]

• Firebase SDK version:
• Library version: 2.15.0
• Firebase Product: auth

I'm trying to verify a token using the following code

from firebase_admin import auth
token = auth.verify_id_token(...)

Everything works great until a token is expired. In that case, I get ValueError.

I think ValueError is pretty generic, wouldn't it make sense to create a custom exception for this so that an app knows what exactly happened?

[hiranya911]

Hi @jvorcak. I agree that Admin SDKs in general require a better and more systematic way of representing errors. To this end we have some draft ideas that we have been tinkering with, but it will be a while before they can be implemented. Almost any change to error handling is a breaking change, and we try to avoid them unless there's a critical need for it. Even changing the above instance from ValueError to something else is breaking, since somebody may already have written code assuming the current behavior.

Having said that, it is my intention to see the error handling of the Python Admin SDK get fixed/revamped by the 3.0.0 release.

Also related #101

[jvorcak]

@hiranya911 totally makes sense. I'm happy that an improvement is already in a roadmap 👍

[hiranya911]

I've started making some progress with this one (see hkj-err-handling branch). Idea is to support something like the following:

from firebase_admin import auth
from firebase_admin import exceptions

try:
  auth.verify_id_token(token)
except auth.FirebaseAuthError as error:
  if error.auth_error_code == auth.EXPIRED_ID_TOKEN:
      print('ID token expired')
  elif error.auth_error_code == auth.INVALID_ID_TOKEN:
      print('Invalid ID token')
  else:
     print('Unexpected error', error.code, error.auth_error_code)

# For even more granular error handling, developers can do this:
try:
  auth.verify_id_token(token)
except auth.FirebaseAuthError as error:
  if error.code == exceptions.INVALID_ARGUMENT:
    if error.auth_error_code == auth.EXPIRED_ID_TOKEN:
      print('ID token expired')
    else:
      print('Invalid ID token')
  else:
    print('Unexpected error while verifying ID tokens')

[hiranya911]

This has been implemented in #317. Following new exception types were introduced:

1. InvalidIdTokenError
2. ExpiredIdTokenError
3. RevokedIdTokenError
4. CertificateFetchError

Will be included in the next major release (planned for late summer)