firebase_id_token 2.5.2 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4cb7c188a4b5026064a64c3a11963be1caae523a448ecc5d998597b7c6989d74
-  data.tar.gz: b0d57512d245bc43ff295bc0987d8529b6881fdcb7c3508d227204c029821725
+  metadata.gz: a7737e97a521a870ff07e83c63f2dbf0d72e89ba85858f42ae9443762518a15a
+  data.tar.gz: 20f27c0f72411d19d6f0efb29fb48528a31c5b6a9ccee7d42300ff61f08833c9
 SHA512:
-  metadata.gz: c17980aaa3e572ac10bf4208ae27ca2dc75781665c219422b23209eb9f7183532d50c2e2491d9036cfd2702cadaddeadb3cac926cf2e7f0d1f0baacc85e22c57
-  data.tar.gz: d9db140915704be2cf596a136e60bc9a4afee5e99eb1eebd35adfb65eeb2beec535ed72188e7a7454413629591f4310f8ae6db050dcd23f4f474dff0737f501f
+  metadata.gz: 2e120f07c5e5017932ab02dcd7955bc3ee292ed360f6da45f56f739394488aa8ae41bab42ab30dbd1f4dd7f51e3dfeed6c3d3a1acd00925656e87be8253a3cda
+  data.tar.gz: a84b333fc8a2a9ad2cec07300ba4ad46a72b9685cebb9cfd0dcb7e2651a123cfed5732487851b76e0a0f8a2ef897989e417418eecf0d38375b287e582a0dd0c9

data/.github/workflows/test.yml

@@ -0,0 +1,28 @@
+name: Test
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+jobs:
+  test:
+    name: "Run Tests"
+    runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis
+        ports:
+        - 6379:6379
+        options: --entrypoint redis-server
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.2.2'
+      - name: Install Bundler
+        run: gem install bundler:2.4.13
+      - name: Install Dependencies
+        run: bundle install
+      - name: Run tests
+        run: bundle exec rspec

data/.ruby-version

@@ -0,0 +1 @@
+3.2.2

data/CHANGELOG.md

@@ -6,7 +6,74 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [2.5.2] - 2023-03-16
+## [4.0.0] - 2026-07-28
+
+### Added
+- Support for verifying Firebase Session Cookies with
+  `FirebaseIdToken::Signature.verify(cookie, type: :session_cookie)`. Session
+  Cookie certificates are downloaded from their own Google API URL and cached
+  apart from the ID Token ones.
+  [PR #46](https://github.com/fschuindt/firebase_id_token/pull/46).
+- Support for any `ActiveSupport::Cache` store through the new
+  `config.cache_store` configuration, with lazy certificate download on cache
+  miss, removing the need for Redis and scheduled certificate requests.
+  [PR #43](https://github.com/fschuindt/firebase_id_token/pull/43), closes
+  [issue #6](https://github.com/fschuindt/firebase_id_token/issues/6). The
+  legacy `config.redis` configuration keeps working as before.
+- A warning on `README.md` that `FirebaseIdToken.test!` must never be called
+  outside of a test suite, as the fixture private key is public in this
+  repository.
+- [Dev] `ostruct` as a development dependency, as it's no longer a default
+  gem in Ruby >= 3.5 and Pry requires it when running the specs.
+
+### Fixed
+- `Signature.verify` raised `NoMethodError` when a correctly signed token had
+  no `sub` claim, even with `raise_error: false`. It now returns `nil` as
+  documented.
+
+### Changed
+- Loosened the HTTParty dependency constraint to `>= 0.21, < 1.0`, allowing
+  newer releases. [Issue #44](https://github.com/fschuindt/firebase_id_token/issues/44).
+- CI now also runs on pull requests.
+
+### Removed
+- The Code Climate coverage publishing step and badges, as the service and
+  its GitHub Action are defunct. SimpleCov still reports coverage on every
+  test run.
+
+## [3.0.0] - 2023-04-11
+
+### Added
+- CI testing using GitHub Actions.
+- Explains on `README.md` about the behavior of `verify` on expired tokens. [Details here](https://github.com/fschuindt/firebase_id_token/issues/29).
+- Warns about the poorly synchronized clocks issue with the token's `iat`. [Details here](https://github.com/fschuindt/firebase_id_token/issues/21#issuecomment-623133926).
+- Gives better examples when testing. [Details here](https://github.com/fschuindt/firebase_id_token/pull/38).
+- Created a `.ruby-version` file.
+- Added ActiveSupport as dependency for `Time.current`.
+- SimpleCov JSON formatter and `json` as dependency.
+
+### Changed
+- Redis is no longer required. Any ActiveSupport cache will now work.
+- It won't default to `Redis.new` anymore. You must now provide Redis details during configuration. [Details here](https://github.com/fschuindt/firebase_id_token/issues/30).
+- Upgraded Redis to 5.0.6.
+- Upgraded Redis Namespace to 1.10.
+- Upgraded HTTParty to 0.21.0.
+- Upgraded JWT to 2.7.
+- Upgraded [Dev] Ruby to 3.2.2.
+- Upgraded [Dev] Bundler to 2.4.13.
+- Upgraded [Dev] Rake to 13.0.6.
+- Upgraded [Dev] RSpec to 3.12.
+- Upgraded [Dev] Redcarpet to 3.6.
+- Upgraded [Dev] Simplecov to 0.22.0.
+- Upgraded [Dev] Pry to 0.14.2.
+
+### Fixed
+- Code Climate test coverage report.
+
+### Removed
+- Travis CI badge.
+
+## [2.5.2] - 2023-04-09
 
 ### Fixed
 - [CWE-472](https://github.com/fschuindt/firebase_id_token/pull/41).
@@ -119,6 +186,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.1.0] - 2017-04-23
 *Version removed.*
 
+[4.0.0]: https://github.com/fschuindt/firebase_id_token/compare/3.0.0...4.0.0
+[3.0.0]: https://github.com/fschuindt/firebase_id_token/compare/2.5.2...3.0.0
+[2.5.2]: https://github.com/fschuindt/firebase_id_token/compare/2.5.1...2.5.2
 [2.5.1]: https://github.com/fschuindt/firebase_id_token/compare/2.5.0...2.5.1
 [2.5.0]: https://github.com/fschuindt/firebase_id_token/compare/2.4.0...2.5.0
 [2.4.0]: https://github.com/fschuindt/firebase_id_token/compare/2.3.2...2.4.0

data/Gemfile

@@ -2,3 +2,10 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in firebase_id_token.gemspec
 gemspec
+
+# connection_pool 3.x is incompatible with ActiveSupport 7.x's
+# RedisCacheStore (positional options hash vs keyword arguments).
+gem 'connection_pool', '< 3.0'
+
+# No longer a default gem in Ruby >= 3.5; needed by pry in the specs.
+gem 'ostruct'

data/README.md

@@ -1,26 +1,18 @@
-# Ruby Firebase ID Token verifier (pre-release)
+# Ruby Firebase ID Token verifier
 
-![Alt text](https://api.travis-ci.org/fschuindt/firebase_id_token.svg?branch=master)
-[![Code Climate](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/gpa.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token)
-[![Issue Count](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/issue_count.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token)
-[![Test Coverage](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/coverage.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token/coverage)
-[![Inline docs](http://inch-ci.org/github/fschuindt/firebase_id_token.svg?branch=master)](http://inch-ci.org/github/fschuindt/firebase_id_token)
+[![Actions Status](https://github.com/fschuindt/firebase_id_token/actions/workflows/test.yml/badge.svg?branch=master)](https://github.com/fschuindt/firebase_id_token/actions/workflows/test.yml)
 
-A Ruby gem to verify the signature of Firebase ID Tokens. It uses Redis to store Google's x509 certificates and manage their expiration time, so you don't need to request Google's API in every execution and can access it as fast as reading from memory.
+A Ruby gem to verify the signature of Firebase ID Tokens (JWT). It uses ActiveSupport::Cache to store Google's x509 certificates and manage their expiration time, so you don't need to request Google's API in every execution and can access it as fast as reading from memory.
 
 It also checks the JWT payload parameters as recommended [here](https://firebase.google.com/docs/auth/admin/verify-id-tokens) by Firebase official documentation.
 
-Feel free to open any issue or to [contact me](https://fschuindt.github.io/blog/about/) directly.  
+Feel free to open any issue or to [contact me](https://fschuindt.github.io/blog/about/) directly.
 Any contribution is welcome.
 
 ## Docs
 
  + http://www.rubydoc.info/gems/firebase_id_token
 
-## Requirements
-
-+ Redis
-
 ## Installing
 
 ```
@@ -29,7 +21,7 @@ gem install firebase_id_token
 
 or in your Gemfile
 ```
-gem 'firebase_id_token', '~> 2.5.2'
+gem 'firebase_id_token', '~> 4.0.0'
 ```
 then
 ```
@@ -43,24 +35,29 @@ It's needed to set up your Firebase Project ID.
 If you are using Rails, this should probably go into `config/initializers/firebase_id_token.rb`.
 ```ruby
 FirebaseIdToken.configure do |config|
+  config.cache_store = ActiveSupport::Cache::RedisCacheStore.new
   config.project_ids = ['your-firebase-project-id']
 end
 ```
 
-`project_ids` must be a Array.
-
-*If you want to verify signatures from more than one Firebase project, just add more Project IDs to the list.*
-
-You can also pass a Redis instance to `config` if you are not using Redis defaults.  
-In this case, you must have the gem `redis` in your `Gemfile`.
+You can use the old method of configuration as well. If you use this method, you'll have to proactively
+download certificates (see [Downloading Certificates](#downloading-certificates) below)
 ```ruby
 FirebaseIdToken.configure do |config|
+  config.redis = Redis.new
   config.project_ids = ['your-firebase-project-id']
-  config.redis = Redis.new(host: '10.0.1.1', port: 6380, db: 15)
 end
 ```
 
-Otherwise, it will use just `Redis.new` as the instance.
+- A cache store instance inheriting from [ActiveSupport::Cache::Store](https://api.rubyonrails.org/classes/ActiveSupport/Cache/Store.html) must be supplied.
+  - Examples:
+    - `ActiveSupport::Cache::RedisCacheStore.new(Redis.new(host: '10.0.1.1', port: 6380, db: 15))`
+    - `ActiveSupport::Cache::MemoryStore.new(namespace: "firebase_auth")`
+    - `ActiveSupport::Cache::FileStore.new("cache", namespace: "firebase_auth")`
+    - `Rails.cache`
+- `project_ids` must be an Array.
+
+*If you want to verify signatures from more than one Firebase project, just add more Project IDs to the list.*
 
 ## Usage
 
@@ -71,45 +68,47 @@ really helpful. But here is a complete guide:
 
 Before verifying tokens, you need to download Google's x509 certificates.
 
-To do it simply:
+To do it, simply:
 ```ruby
 FirebaseIdToken::Certificates.request
 ```
 
-It will download the certificates and save it in Redis, but only if Redis certificates database is empty. To force download and override Redis database, use:
+It will download the certificates and save it in cache, but only if the cache certificates database is empty. To force download and override of the cache entries, use:
 ```ruby
 FirebaseIdToken::Certificates.request!
 ```
 
-Google give us information about the certificates expiration time, it's used to set a Redis TTL (Time-To-Live) when saving it. By doing so, the certificates will be automatically deleted after its expiration.
+Google give us information about the certificates' expiration time, it's used to set a cache TTL (Time-To-Live) when saving it. By doing so, the certificates will be automatically deleted after its expiration.
 
 #### Certificates Info
 
-Checks the presence of certificates in Redis database.
+Checks the presence of certificates in the cache.
 ```ruby
 FirebaseIdToken::Certificates.present?
 => true
 ```
 
-How many seconds until the certificate's expiration.
+How many seconds until the certificate's expiration. _NOTE_: Currently only functional when using Redis
 ```ruby
 FirebaseIdToken::Certificates.ttl
 => 22352
 ```
 
-Lists all certificates in a database.
+Lists all certificates in the database.
 ```ruby
 FirebaseIdToken::Certificates.all
 => [{"ec8f292sd30224afac5c55540df66d1f999d" => <OpenSSL::X509::Certificate: [...]]
 ```
 
-Finds the respective certificate of a given Key ID.
+Finds the respective certificate of a given Key ID (`kid`).
 ```ruby
 FirebaseIdToken::Certificates.find('ec8f292sd30224afac5c55540df66d1f999d')
 => <OpenSSL::X509::Certificate: subject=<OpenSSL::X509 [...]>
 ```
 
 #### Downloading in Rails
+If you pass in the `cache_store` configuration option (see [configuration](#configuration)), the certificates will be
+requested at runtime when needed and you can ignore this section.
 
 If you are using Rails, it's clever to download certificates in a cron task, you can use [whenever](https://github.com/javan/whenever).
 
@@ -121,12 +120,12 @@ Create your task in `lib/tasks/firebase.rake`:
 ```ruby
 namespace :firebase do
   namespace :certificates do
-    desc "Request Google's x509 certificates when Redis is empty"
+    desc "Request Google's x509 certificates when the cache is empty"
     task request: :environment do
       FirebaseIdToken::Certificates.request
     end
 
-    desc "Request Google's x509 certificates and override Redis"
+    desc "Request Google's x509 certificates and override the cache"
     task force_request: :environment do
       FirebaseIdToken::Certificates.request!
     end
@@ -153,7 +152,7 @@ When developing, you should just run the task:
 $ rake firebase:certificates:request
 ```
 
-*And remember, you need the Redis server to be running.*
+*You need Redis to be running if you're using RedisCacheStore*
 
 ### Verifying Tokens
 
@@ -173,30 +172,65 @@ FirebaseIdToken::Signature.verify('aaaaaa')
 => nil
 ```
 
-**WARNING:** If you try to verify a signature without any certificates in Redis database it will raise a `FirebaseIdToken::Exceptions::NoCertificatesError`.
+#### Verifying Session Cookies
+
+[Firebase Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies) are issued by `https://session.firebase.google.com` and signed by a different certificate set than ID Tokens. Pass `type: :session_cookie` to verify one:
+
+```ruby
+FirebaseIdToken::Signature.verify(session_cookie, type: :session_cookie)
+=> {"iss"=>"https://session.firebase.google.com/firebase-id-token", "name"=>"Bob Test", [...]}
+```
+
+When using the `cache_store` configuration, the Session Cookie certificates are downloaded automatically on the first verification, just like the ID Token ones. If you are on the legacy Redis configuration and download certificates with a cron task, you also need to request the Session Cookie certificates:
+
+```ruby
+FirebaseIdToken::Certificates.request(source: :session_cookie)
+```
+
+#### WARNING!
+
+##### Expired tokens can point to long gone certificates
+
+Notice that often when the token have expired, the Firebase certificate can be already missing from the Firebase servers. In these cases, `verify` will return `nil`.
+
+If you want to take specific actions in such cases, here's a solution suggested by the user [cfanpnk](https://github.com/fschuindt/firebase_id_token/issues/29#issuecomment-751137511):
+
+1. Use `verify!` to raise an exception.
+2. Rescue `FirebaseIdToken::Exceptions::CertificateNotFound` and return `401`.
+3. The client app will refresh the token if expired.
+
+More details [here](https://github.com/fschuindt/firebase_id_token/issues/29).
+
+##### Trying to verify tokens without downloaded certificates will raise an error
+
+If you try to verify a signature without any certificates in the cache, it will raise a `FirebaseIdToken::Exceptions::NoCertificatesError`.
+
+##### "I keep on getting `nil` on `verify`"
+
+Poorly synchronized clocks will sometimes make the server think the token's `iat` is on the future, which will render the token as invalid. Make sure your server's or development system's clock is correctly set. On macOS, some people reported success by unchecking and checking the "Set date and time automatically" configuration checkbox. See [here](https://github.com/fschuindt/firebase_id_token/issues/21#issuecomment-623133926).
 
 #### Payload Structure
 
 In case you need, here's a example of the payload structure from a Google login in JSON.
 ```json
-{  
-   "iss":"https://securetoken.google.com/firebase-id-token",
+{
+   "iss":"https://securetoken.google.com/{{YOUR_FIREBASE_APP_ID}}",
    "name":"Ugly Bob",
    "picture":"https://someurl.com/photo.jpg",
-   "aud":"firebase-id-token",
+   "aud":"{{YOUR_FIREBASE_APP_ID}}",
    "auth_time":1492981192,
    "user_id":"theUserID",
    "sub":"theUserID",
-   "iat":1492981200,
-   "exp":33029000017,
+   "iat":1492981200, // needs to be in the past
+   "exp":33029000017, // needs to be in the future
    "email":"uglybob@emailurl.com",
    "email_verified":true,
-   "firebase":{  
-      "identities":{  
-         "google.com":[  
+   "firebase":{
+      "identities":{
+         "google.com":[
             "1010101010101010101"
          ],
-         "email":[  
+         "email":[
             "uglybob@emailurl.com"
          ]
       },
@@ -206,34 +240,42 @@ In case you need, here's a example of the payload structure from a Google login
 
 ```
 
+If you're using this snippet for testing, make sure you check the comments in it.
 
-## Development
-The test suite can be run with `bundle exec rake rspec`
+## Testing
 
+```
+bundle exec rake rspec
+```
 
-The test mode is prepared as preparation for the test.
+### Testing Mode
 
-`FirebaseIdToken.test!`
+Just run:
+```
+FirebaseIdToken.test!
+```
 
+> **Warning**
+> `FirebaseIdToken.test!` replaces signature verification with a fixture
+> certificate whose private key is publicly available in this repository.
+> Never call it outside of your test suite. An application running in test
+> mode will accept forged tokens crafted by anyone.
 
-By using test mode, the following methods become available.
+By using this mode, the following methods become available.
 
 ```ruby
 # RSA PRIVATE KEY
 FirebaseIdToken::Testing::Certificates.private_key
+
 # CERTIFICATE
 FirebaseIdToken::Testing::Certificates.certificate
 ```
 
-CERTIFICATE will always return the same value and will not communicate to google.
+`certificate` will always return the same value. No external HTTP call is performed.
 
+#### Example: Testing in Rails
 
-### Example
-#### Rails test
-
-Describe the following in test_helper.rb etc.
-
-* test_helper
+Describes the following in `test_helper.rb`.
 
 ```ruby
 class ActiveSupport::TestCase
@@ -243,7 +285,7 @@ class ActiveSupport::TestCase
 end
 ```
 
-* controller_test
+Test example:
 
 ```ruby
 require 'test_helper'
@@ -255,7 +297,7 @@ module Api
         @routes = Engine.routes
         @user = users(:one)
       end
-        
+
       def create_token(sub: nil)
         _payload = payload.merge({sub: sub})
         JWT.encode _payload, OpenSSL::PKey::RSA.new(FirebaseIdToken::Testing::Certificates.private_key), 'RS256'
@@ -274,7 +316,6 @@ module Api
 end
 ```
 
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

data/firebase_id_token.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
 
   spec.summary       = 'A Firebase ID Token verifier.'
   spec.description   = "A Ruby gem to verify the signature of Firebase ID "\
-    "Tokens. It uses Redis to store Google's x509 certificates and manage "\
+    "Tokens. It uses ActiveSupport::Cache to store Google's x509 certificates and manage "\
     "their expiration time, so you don't need to request Google's API in "\
     "every execution and can access it as fast as reading from memory."
   spec.homepage      = 'https://github.com/fschuindt/firebase_id_token'
@@ -22,16 +22,18 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'bundler', '~> 2.3', '>= 2.3.11'
-  spec.add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'
-  spec.add_development_dependency 'rspec', '~> 3.0'
-  spec.add_development_dependency 'redcarpet', '~> 3.4', '>= 3.4.0'
-  spec.add_development_dependency 'simplecov', '~> 0.14.1'
-  spec.add_development_dependency 'codeclimate-test-reporter', '~> 1.0', '>= 1.0.0'
-  spec.add_development_dependency 'pry', '~> 0.12.2'
+  spec.add_development_dependency 'bundler', '~> 2.4', '>= 2.4.13'
+  spec.add_development_dependency 'rake', '~> 13.0', '>= 13.0.6'
+  spec.add_development_dependency 'rspec', '~> 3.12'
+  spec.add_development_dependency 'redcarpet', '~> 3.6'
+  spec.add_development_dependency 'simplecov', '~> 0.22.0'
+  spec.add_development_dependency 'simplecov_json_formatter', '~> 0.1.2'
+  spec.add_development_dependency 'pry', '~> 0.14.2'
+  spec.add_development_dependency 'redis', '~> 5.0', '>= 5.0.6'
+  spec.add_development_dependency 'redis-namespace', '~> 1.10'
 
-  spec.add_runtime_dependency 'redis', '~> 4.0', '>= 4.0.1'
-  spec.add_runtime_dependency 'redis-namespace', '~> 1.6', '>= 1.6.0'
-  spec.add_dependency 'httparty', '~> 0.21', '>= 0.16.2'
-  spec.add_runtime_dependency 'jwt', '~> 2.1', '>= 2.1.0'
+  spec.add_dependency 'httparty', '>= 0.21', '< 1.0'
+  spec.add_runtime_dependency 'jwt', '~> 2.7'
+  spec.add_runtime_dependency 'activesupport', '~> 7.0', '>= 7.0.4.3'
+  spec.add_runtime_dependency 'json', '~> 2.6', '>= 2.6.3'
 end

data/lib/firebase_id_token/certificates/active_support.rb

@@ -0,0 +1,92 @@
+module FirebaseIdToken
+  # ActiveSupport specific methods for Certificates class
+  class Certificates::ActiveSupport < Certificates
+    attr_reader :cache_store
+    RACE_CONDITION_TIME = 5.seconds
+
+    def initialize(source: :id_token)
+      @source = source
+      @cache_store = ::FirebaseIdToken.configuration.cache_store
+      @local_certs = read_certificates
+    end
+
+    def self.ttl(source: :id_token)
+      current_time = Time.now.to_i
+      entry = new(source: source).cache_store.read CACHE_KEYS.fetch(source)
+      if entry
+        expires_at = JSON.parse(entry)["expires_at"]
+        return expires_at - current_time < 0 ? 0 : expires_at - current_time
+      end
+      return 0
+    end
+
+    private
+
+    def read_certificates
+      entry = cache_store.read(cache_key)
+      if entry.nil?
+        lock do
+          request!
+        end
+        entry = cache_store.read(cache_key)
+      end
+      certs = {}
+      certs = JSON.parse(JSON.parse(entry)["data"]) if entry
+      certs
+    rescue StandardError => e
+      return {}
+    end
+
+    # we can't use ActiveSupport's fetch, because we need to set the expiration time of
+    # the key based on a value we read from the request. This is a rudimentary mutex instead
+    def lock
+      acquire_lock
+      yield
+    ensure
+      release_lock
+    end
+
+    def acquire_lock
+      maybe_sleep
+      cache_store.write(lock_key, true, expires_in: 5.seconds)
+    end
+
+    def maybe_sleep
+      iteration = 0
+      while cache_store.exist?(lock_key)
+        iteration += 1
+        sleep 1
+        break if iteration > 5
+      end
+    end
+
+    def release_lock
+      cache_store.delete(lock_key)
+    end
+
+    def lock_key
+      "#{cache_key}_lock"
+    end
+
+    def save_certificates
+      expires_at = Time.now.to_i + ttl
+      # set the expiration of the key to the certification expiration - RACE_CONDITION_TIME, so that the entry
+      # will be expired before the certificate is
+      cache_store.write cache_key, { data: @request.body, expires_at: expires_at }.to_json,
+        expires_in: (ttl - RACE_CONDITION_TIME)
+      @local_certs = @request.body
+    end
+
+    def ttl
+      cache_control = @request.headers['cache-control']
+      ttl = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
+
+      if ttl > 3600
+        ttl
+      else
+        raise ::FirebaseIdToken::Exceptions::CertificatesTtlError
+      end
+    end
+  end
+end
+

data/lib/firebase_id_token/certificates/redis.rb

@@ -0,0 +1,46 @@
+module FirebaseIdToken
+  # Redis specific methods for Certificates class
+  class Certificates::Redis < Certificates
+    attr_reader :redis
+
+    def initialize(source: :id_token)
+      @source = source
+      @redis = ::Redis::Namespace.new('firebase_id_token',
+        redis: FirebaseIdToken.configuration.redis)
+      @local_certs = read_certificates
+    end
+
+    # Returns the current certificates TTL (Time-To-Live) in seconds. *Zero
+    # meaning no certificates.* It's the same as the certificates expiration
+    # time, use it to know when to request again.
+    # @return [Fixnum]
+    def self.ttl(source: :id_token)
+      ttl = new(source: source).redis.ttl(CACHE_KEYS.fetch(source))
+      ttl < 0 ? 0 : ttl
+    end
+
+    private
+
+    def read_certificates
+      certs = @redis.get cache_key
+      certs ? JSON.parse(certs) : {}
+    end
+
+    def save_certificates
+      @redis.setex cache_key, ttl, @request.body
+      @local_certs = read_certificates
+    end
+
+    def ttl
+      cache_control = @request.headers['cache-control']
+      ttl = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
+
+      if ttl > 3600
+        ttl
+      else
+        raise Exceptions::CertificatesTtlError
+      end
+    end
+  end
+end
+