firebase_id_token 2.5.2 → 4.0.0

data/lib/firebase_id_token/certificates.rb

@@ -1,22 +1,22 @@
 module FirebaseIdToken
   # Manage download and access of Google's x509 certificates. Keeps
-  # certificates on a Redis namespace database.
+  # certificates on an ActiveSupport cache.
   #
   # ## Download & Access Certificates
   #
   # It describes two ways to download it: {.request} and {.request!}.
-  # The first will only do something when Redis certificates database is empty,
+  # The first will only do something when the certificates cache is empty,
   # the second one will always request a new download to Google's API and
   # override the database with the response.
   #
   # It's important to note that when saving a set of certificates, it will also
-  # set a Redis expiration time to match Google's API header `expires`. **After
-  # this time went out, Redis will automatically delete those certificates.**
+  # set a expiration time to match Google's API header `expires`. **After
+  # this time went out, the cache will no longer provide those certificates.**
   #
   # *To know how many seconds left until the expiration you can use {.ttl}.*
   #
   # When comes to accessing it, you can either use {.present?} to check if
-  # there's any data inside Redis certificates database or {.all} to obtain an
+  # there's any data inside the cache or {.all} to obtain an
   # `Array` of current certificates.
   #
   # @example `.request` will only download once
@@ -30,30 +30,46 @@ module FirebaseIdToken
   #   FirebaseIdToken::Certificates.request! # Downloads certificates.
   #
   class Certificates
-    # A Redis instance.
-    attr_reader :redis
-    # Certificates saved in the Redis (JSON `String` or `nil`).
+    # Certificates saved in the cache (JSON `String` or `nil`).
     attr_reader :local_certs
 
-    # Google's x509 certificates API URL.
+    # Certificate source (`:id_token` or `:session_cookie`).
+    attr_reader :source
+
+    # Google's x509 certificates API URL for ID Tokens.
     URL = 'https://www.googleapis.com/robot/v1/metadata/x509/'\
       'securetoken@system.gserviceaccount.com'
 
-    # Calls {.request!} only if there are no certificates on Redis. It will
+    # Google's x509 certificates API URL for Session Cookies. Session Cookies
+    # are signed by a different key set than ID Tokens.
+    SESSION_COOKIE_URL = 'https://www.googleapis.com/identitytoolkit/v3/'\
+      'relyingparty/publicKeys'
+
+    # Certificates API URL of each source.
+    URLS = { id_token: URL, session_cookie: SESSION_COOKIE_URL }.freeze
+
+    # Cache key of each source, so both certificate sets live side by side.
+    CACHE_KEYS = {
+      id_token: 'certificates',
+      session_cookie: 'session_cookie_certificates'
+    }.freeze
+
+    # Calls {.request!} only if there are no certificates in the cache. It will
     # return `nil` otherwise.
     #
     # It will raise {Exceptions::CertificatesRequestError} if the request
     # fails or {Exceptions::CertificatesTtlError} when Google responds with a
     # low TTL, check out {.request!} for more info.
     #
+    # @param [Symbol] source `:id_token` (default) or `:session_cookie`
     # @return [nil, Hash]
     # @see Certificates.request!
-    def self.request
-      new.request
+    def self.request(source: :id_token)
+      new_child(source: source).request
     end
 
     # Triggers a HTTPS request to Google's x509 certificates API. If it
-    # responds with a status `200 OK`, saves the request body into Redis and
+    # responds with a status `200 OK`, saves the request body into the cache and
     # returns it as a `Hash`.
     #
     # Otherwise it will raise a {Exceptions::CertificatesRequestError}.
@@ -61,9 +77,10 @@ module FirebaseIdToken
     # This is really rare to happen, but Google may respond with a low TTL
     # certificate. This is a `SecurityError` and will raise a
     # {Exceptions::CertificatesTtlError}. You are mostly like to never face it.
+    # @param [Symbol] source `:id_token` (default) or `:session_cookie`
     # @return [Hash]
-    def self.request!
-      new.request!
+    def self.request!(source: :id_token)
+      new_child(source: source).request!
     end
 
     # @deprecated Use only `request!` in favor of Ruby conventions.
@@ -73,46 +90,46 @@ module FirebaseIdToken
       warn 'WARNING: FirebaseIdToken::Certificates.request_anyway is '\
         'deprecated. Use FirebaseIdToken::Certificates.request! instead.'
 
-      new.request!
+      new_child.request!
     end
 
-    # Returns `true` if there's certificates data on Redis, `false` otherwise.
+    # Returns `true` if there's certificates data in the cache, `false` otherwise.
     # @example
     #   FirebaseIdToken::Certificates.present? #=> false
     #   FirebaseIdToken::Certificates.request
     #   FirebaseIdToken::Certificates.present? #=> true
-    def self.present?
-      ! new.local_certs.empty?
+    def self.present?(source: :id_token)
+      ! new_child(source: source).local_certs.empty?
     end
 
     # Returns an array of hashes, each hash is a single `{key => value}` pair
     # containing the certificate KID `String` as key and a
     # `OpenSSL::X509::Certificate` object of the respective certificate as
-    # value. Returns a empty `Array` when there's no certificates data on
-    # Redis.
+    # value. Returns a empty `Array` when there's no certificates data in
+    # the cache.
     # @return [Array]
     # @example
     #   FirebaseIdToken::Certificates.request
     #   certs = FirebaseIdToken::Certificates.all
     #   certs.first #=> {"1d6d01c7[...]" => #<OpenSSL::X509::Certificate[...]}
-    def self.all
-      new.local_certs.map { |kid, cert|
+    def self.all(source: :id_token)
+      new_child(source: source).local_certs.map { |kid, cert|
         { kid => OpenSSL::X509::Certificate.new(cert) } }
     end
 
     # Returns a `OpenSSL::X509::Certificate` object of the requested Key ID
     # (KID) if there's one. Returns `nil` otherwise.
     #
-    # It will raise a {Exceptions::NoCertificatesError} if the Redis
-    # certificates database is empty.
+    # It will raise a {Exceptions::NoCertificatesError} if the
+    # certificates cache is empty.
     # @param [String] kid Key ID
     # @return [nil, OpenSSL::X509::Certificate]
     # @example
     #   FirebaseIdToken::Certificates.request
     #   cert = FirebaseIdToken::Certificates.find "1d6d01f4w7d54c7[...]"
     #   #=> <OpenSSL::X509::Certificate: subject=#<OpenSSL [...]
-    def self.find(kid, raise_error: false)
-      certs = new.local_certs
+    def self.find(kid, raise_error: false, source: :id_token)
+      certs = new_child(source: source).local_certs
       raise Exceptions::NoCertificatesError if certs.empty?
 
       return OpenSSL::X509::Certificate.new certs[kid] if certs[kid]
@@ -128,8 +145,8 @@ module FirebaseIdToken
     #
     # @raise {Exceptions::CertificateNotFound} if it cannot be found.
     #
-    # @raise {Exceptions::NoCertificatesError} if the Redis certificates
-    # database is empty.
+    # @raise {Exceptions::NoCertificatesError} if the certificates cache
+    # is empty.
     #
     # @param [String] kid Key ID
     # @return [OpenSSL::X509::Certificate]
@@ -137,26 +154,33 @@ module FirebaseIdToken
     #   FirebaseIdToken::Certificates.request
     #   cert = FirebaseIdToken::Certificates.find! "1d6d01f4w7d54c7[...]"
     #   #=> <OpenSSL::X509::Certificate: subject=#<OpenSSL [...]
-    def self.find!(kid)
-      find(kid, raise_error: true)
+    def self.find!(kid, source: :id_token)
+      find(kid, raise_error: true, source: source)
     end
 
     # Returns the current certificates TTL (Time-To-Live) in seconds. *Zero
     # meaning no certificates.* It's the same as the certificates expiration
     # time, use it to know when to request again.
     # @return [Fixnum]
-    def self.ttl
-      ttl = new.redis.ttl('certificates')
-      ttl < 0 ? 0 : ttl
+    def self.ttl(source: :id_token)
+      # call a child class based on the configuration
+      FirebaseIdToken.configuration.klass.ttl(source: source)
+    end
+
+    # When called on Certificates itself, picks the store class from the
+    # configuration. When called on a subclass, instantiates that subclass.
+    def self.new_child(source: :id_token)
+      return new(source: source) unless self == Certificates
+
+      FirebaseIdToken.configuration.klass.new(source: source)
     end
 
-    # Sets two instance attributes: `:redis` and `:local_certs`. Those are
-    # respectively a Redis instance from {FirebaseIdToken::Configuration} and
+    # Sets two instance attributes: `:cach_store` and `:local_certs`. Those are
+    # respectively a cache instance from {FirebaseIdToken::Configuration} and
     # the certificates in it.
-    def initialize
-      @redis = Redis::Namespace.new('firebase_id_token',
-        redis: FirebaseIdToken.configuration.redis)
-      @local_certs = read_certificates
+    def initialize(source: :id_token)
+      # this should not be called directly. Call a child class
+      raise NotImplementedError
     end
 
     # @see Certificates.request
@@ -166,7 +190,7 @@ module FirebaseIdToken
 
     # @see Certificates.request!
     def request!
-      @request = HTTParty.get URL
+      @request = HTTParty.get URLS.fetch(@source)
       code = @request.code
       if code == 200
         save_certificates
@@ -177,25 +201,10 @@ module FirebaseIdToken
 
     private
 
-    def read_certificates
-      certs = @redis.get 'certificates'
-      certs ? JSON.parse(certs) : {}
-    end
-
-    def save_certificates
-      @redis.setex 'certificates', ttl, @request.body
-      @local_certs = read_certificates
-    end
-
-    def ttl
-      cache_control = @request.headers['cache-control']
-      ttl = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
-
-      if ttl > 3600
-        ttl
-      else
-        raise Exceptions::CertificatesTtlError
-      end
+    # Cache key of the certificate source, so ID Token and Session Cookie
+    # certificates never mix.
+    def cache_key
+      CACHE_KEYS.fetch(@source)
     end
   end
 end

data/lib/firebase_id_token/configuration.rb

@@ -4,12 +4,19 @@ module FirebaseIdToken
   LIB_PATH = File.expand_path('../../', __FILE__)
 
   class Configuration
-    attr_accessor :redis, :project_ids, :certificates
+    attr_accessor :redis, :project_ids, :cache_store
+    attr_writer :certificates
 
     def initialize
-      @redis = Redis.new
       @project_ids = []
-      @certificates = FirebaseIdToken::Certificates
+    end
+
+    def certificates
+      @certificates || klass
+    end
+
+    def klass
+      redis ? FirebaseIdToken::Certificates::Redis : FirebaseIdToken::Certificates::ActiveSupport
     end
   end
 end

data/lib/firebase_id_token/exceptions/unsupported_cache_operation_error.rb

@@ -0,0 +1,11 @@
+module FirebaseIdToken
+  module Exceptions
+    # @see FirebaseIdToken::Certificates.request
+    # @see FirebaseIdToken::Certificates.request!
+    class UnsupportedCacheOperationError < StandardError
+      def initialize(message = "Cache store does not support a TTL read on entries")
+        super message
+      end
+    end
+  end
+end

data/lib/firebase_id_token/signature.rb

@@ -10,13 +10,13 @@ module FirebaseIdToken
   #
   # ## Verifying a Firebase ID Token
   #
-  # *Be sure to configure the gem to set your Firebase Project ID and a Redis
-  # server before move any forward.*
+  # *Be sure to configure the gem to set your Firebase Project ID cache
+  # store.*
   #
   # **See the README for a complete guide.**
   #
   # **WARNING:** Trying to verify a token without any certificate saved in
-  # Redis certificates database raises a {Exceptions::NoCertificatesError}.
+  # the cache raises a {Exceptions::NoCertificatesError}.
   #
   # @example
   #   FirebaseIdToken::Signature.verify(thrusty_token)
@@ -31,6 +31,12 @@ module FirebaseIdToken
     # [here](https://goo.gl/uOK5Jx).
     JWT_DEFAULTS = { algorithm: 'RS256', verify_iat: true }
 
+    # Issuer base URL of each token type.
+    ISSUER_BASE_URLS = {
+      id_token: 'https://securetoken.google.com',
+      session_cookie: 'https://session.firebase.google.com'
+    }.freeze
+
     # Returns the decoded JWT hash payload of the Firebase ID Token if the
     # signature in the token matches with one of the certificates downloaded
     # by {FirebaseIdToken::Certificates.request}, returns `nil` otherwise.
@@ -39,8 +45,8 @@ module FirebaseIdToken
     # JWT fields are valid, as recommended [here](https://goo.gl/yOrZZX) by
     # Firebase official documentation.
     #
-    # Note that it will raise a {Exceptions::NoCertificatesError} if the Redis
-    # certificates database is empty. Ensure to call {Certificates.request}
+    # Note that it will raise a {Exceptions::NoCertificatesError} if the cache
+    # is empty. Ensure to call {Certificates.request}
     # before, ideally in a background job if you are using Rails.
     #
     # If you would like this to raise and error, rather than silently failing,
@@ -49,18 +55,26 @@ module FirebaseIdToken
     #   FirebaseIdToken::Signature
     #     .verify(token, raise_error: Rails.env.development?)
     #
+    # Use `type: :session_cookie` to verify a Firebase Session Cookie instead
+    # of an ID Token. Session Cookies are issued by
+    # `https://session.firebase.google.com` and signed by a different
+    # certificate set. Example:
+    #
+    #   FirebaseIdToken::Signature.verify(cookie, type: :session_cookie)
+    #
     # @param raise_error [Boolean] default: false
+    # @param type [Symbol] `:id_token` (default) or `:session_cookie`
     # @return [nil, Hash]
-    def self.verify(jwt_token, raise_error: false)
-      new(jwt_token, raise_error: raise_error).verify
+    def self.verify(jwt_token, raise_error: false, type: :id_token)
+      new(jwt_token, raise_error: raise_error, type: type).verify
     end
 
     # Equivalent to `.verify(jwt_token, raise_error: true)`.
     #
     # @see {Signature.verify}
     # @return [Hash]
-    def self.verify!(jwt_token)
-      new(jwt_token, raise_error: true).verify
+    def self.verify!(jwt_token, type: :id_token)
+      new(jwt_token, raise_error: true, type: type).verify
     end
 
     attr_accessor :firebase_id_token_certificates
@@ -68,8 +82,9 @@ module FirebaseIdToken
     # Loads attributes: `:project_ids` from {FirebaseIdToken::Configuration},
     # and `:kid`, `:jwt_token` from the related `jwt_token`.
     # @param [String] jwt_token Firebase ID Token
-    def initialize(jwt_token, raise_error: false)
+    def initialize(jwt_token, raise_error: false, type: :id_token)
       @raise_error = raise_error
+      @type = type
       @project_ids = FirebaseIdToken.configuration.project_ids
       @kid = extract_kid(jwt_token)
       @jwt_token = jwt_token
@@ -78,7 +93,8 @@ module FirebaseIdToken
 
     # @see Signature.verify
     def verify
-      certificate = firebase_id_token_certificates.find(@kid, raise_error: @raise_error)
+      certificate = firebase_id_token_certificates.find(
+        @kid, raise_error: @raise_error, source: @type)
       return unless certificate
 
       payload = decode_jwt_payload(@jwt_token, certificate.public_key)
@@ -113,7 +129,7 @@ module FirebaseIdToken
       still_valid?(payload) &&
       @project_ids.include?(payload['aud']) &&
       issuer_authorized?(payload) &&
-      ! payload['sub'].empty?
+      ! payload['sub'].to_s.empty?
     end
 
     def still_valid?(payload)
@@ -122,7 +138,8 @@ module FirebaseIdToken
     end
 
     def issuer_authorized?(payload)
-      issuers = @project_ids.map { |i| "https://securetoken.google.com/#{i}" }
+      base_url = ISSUER_BASE_URLS.fetch(@type)
+      issuers = @project_ids.map { |i| "#{base_url}/#{i}" }
       issuers.include? payload['iss']
     end
   end

data/lib/firebase_id_token/testing/certificates.rb

@@ -15,7 +15,7 @@ module FirebaseIdToken
       # `.find` is stubbed to always return the same certificate.
       # @param [String] kid Key ID
       # @return [nil, OpenSSL::X509::Certificate]
-      def self.find(kid, raise_error: false)
+      def self.find(kid, raise_error: false, source: :id_token)
         cert = certificate
         OpenSSL::X509::Certificate.new cert
       end

data/lib/firebase_id_token/version.rb

@@ -1,3 +1,3 @@
 module FirebaseIdToken
-  VERSION = '2.5.2'
+  VERSION = '4.0.0'
 end

data/lib/firebase_id_token.rb

@@ -1,15 +1,19 @@
-require 'redis'
-require 'redis-namespace'
 require 'httparty'
 require 'jwt'
+require 'active_support'
+require 'active_support/time'
+require 'active_support/cache'
 
 require 'firebase_id_token/version'
 require 'firebase_id_token/exceptions/no_certificates_error'
 require 'firebase_id_token/exceptions/certificates_request_error'
 require 'firebase_id_token/exceptions/certificates_ttl_error'
+require 'firebase_id_token/exceptions/unsupported_cache_operation_error'
 require 'firebase_id_token/exceptions/certificate_not_found'
 require 'firebase_id_token/configuration'
 require 'firebase_id_token/certificates'
+require 'firebase_id_token/certificates/active_support'
+require 'firebase_id_token/certificates/redis'
 require 'firebase_id_token/signature'
 
 # ## List of available methods
@@ -28,20 +32,18 @@ require 'firebase_id_token/signature'
 #
 # ## Configuration
 #
-# You need to set your Firebase Project ID. Additionally you can set your Redis
-# server instance in case you don't use Redis defaults.
+# You need to set your Firebase Project ID and cache store.
 #
 # **WARNING:** Your `project_ids` must be a `Array`.
 # ```
 # FirebaseIdToken.configure do |config|
 #   config.project_ids = ['my-project-id', 'another-project-id']
-#   congig.redis = Redis.new(:host => "10.0.1.1", :port => 6380, :db => 15)
+#   congig.cache_store = ActiveSupport::Cache::RedisCacheStore.new
 # end
 # ```
 #
 # **Defaults**
 # + `project_ids` => `[]`
-# + `redis` => `Redis.new`
 #
 module FirebaseIdToken
   class << self

data/spec/firebase_id_token/certificates/active_support_spec.rb

@@ -0,0 +1,43 @@
+require 'spec_helper'
+require 'firebase_id_token/certificates/active_support'
+
+module FirebaseIdToken
+  describe Certificates::ActiveSupport do
+    let (:certs) { File.read('spec/fixtures/files/certificates.json') }
+    let (:cache) { 'public, max-age=19302, must-revalidate, no-transform' }
+    let (:low_cache) { 'public, max-age=2160, must-revalidate, no-transform' }
+    let (:kid) { JSON.parse(certs).first[0] }
+    let (:expires_in) { (DateTime.now + (5/24r)).to_s }
+    let (:response) { double }
+
+    let (:mock_response) {
+      allow(response).to receive(:code) { 200 }
+      allow(response).to receive(:headers) { { 'cache-control' => cache } }
+      allow(response).to receive(:body) { certs }
+    }
+
+    let(:mock_request) {
+      mock_response
+      allow(HTTParty).to receive(:get).
+        with(an_instance_of(String)) { response }
+    }
+
+    context 'RedisCacheStore' do
+      before :each do
+        allow(FirebaseIdToken.configuration).to receive(:cache_store).and_return(
+          ActiveSupport::Cache::RedisCacheStore.new(namespace: 'firebase_id_token_test'))
+        FirebaseIdToken.configuration.cache_store.delete 'certificates'
+      end
+      it_behaves_like 'a certificate store', lazy: true
+    end
+
+    context 'MemoryStore' do
+      before :each do
+        allow(FirebaseIdToken.configuration).to receive(:cache_store).and_return(
+          ActiveSupport::Cache::MemoryStore.new(namespace: "firebase_auth"))
+        FirebaseIdToken.configuration.cache_store.delete 'certificates'
+      end
+      it_behaves_like 'a certificate store', lazy: true
+    end
+  end
+end

data/spec/firebase_id_token/certificates/redis_spec.rb

@@ -0,0 +1,39 @@
+require 'spec_helper'
+require 'redis'
+require 'redis-namespace'
+require 'firebase_id_token/certificates/redis'
+
+module FirebaseIdToken
+  describe Certificates::Redis do
+    let (:redis) { Redis::Namespace.new 'firebase_id_token', redis: Redis.new }
+    let (:certs) { File.read('spec/fixtures/files/certificates.json') }
+    let (:cache) { 'public, max-age=19302, must-revalidate, no-transform' }
+    let (:low_cache) { 'public, max-age=2160, must-revalidate, no-transform' }
+    let (:kid) { JSON.parse(certs).first[0] }
+    let (:expires_in) { (DateTime.now + (5/24r)).to_s }
+    let (:response) { double }
+
+    let (:mock_response) {
+      allow(response).to receive(:code) { 200 }
+      allow(response).to receive(:headers) { { 'cache-control' => cache } }
+      allow(response).to receive(:body) { certs }
+    }
+
+    let(:mock_request) {
+      mock_response
+      allow(HTTParty).to receive(:get).
+        with(an_instance_of(String)) { response }
+    }
+
+    before :each do
+      FirebaseIdToken.configure { |config| config.redis = ::Redis.new }
+      redis.del 'certificates'
+    end
+
+    after :each do
+      FirebaseIdToken.reset
+    end
+
+    it_behaves_like 'a certificate store'
+  end
+end

data/spec/firebase_id_token/certificates_session_cookie_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+module FirebaseIdToken
+  describe 'Certificates with the session cookie source' do
+    let (:certs) { File.read('spec/fixtures/files/certificates.json') }
+    let (:cache) { 'public, max-age=19302, must-revalidate, no-transform' }
+    let (:kid) { JSON.parse(certs).first[0] }
+    let (:response) { double }
+
+    before :each do
+      allow(response).to receive(:code) { 200 }
+      allow(response).to receive(:headers) { { 'cache-control' => cache } }
+      allow(response).to receive(:body) { certs }
+      allow(HTTParty).to receive(:get).with(an_instance_of(String)) { response }
+      allow(FirebaseIdToken.configuration).to receive(:cache_store).and_return(
+        ActiveSupport::Cache::MemoryStore.new(namespace: 'firebase_auth'))
+    end
+
+    after :each do
+      FirebaseIdToken.reset
+    end
+
+    it 'requests the session cookie certificates URL' do
+      expect(HTTParty).to receive(:get).
+        with(Certificates::SESSION_COOKIE_URL).at_least(:once) { response }
+
+      Certificates.request!(source: :session_cookie)
+    end
+
+    it 'stores session cookie certificates apart from ID Token ones' do
+      Certificates.request!(source: :session_cookie)
+      cache_store = FirebaseIdToken.configuration.cache_store
+
+      expect(cache_store.read('session_cookie_certificates')).not_to be_nil
+      expect(cache_store.read('certificates')).to be_nil
+    end
+
+    it 'finds a certificate by kid on the session cookie source' do
+      expect(Certificates.find(kid, source: :session_cookie)).
+        to be_a(OpenSSL::X509::Certificate)
+    end
+
+    it 'reports the TTL of the session cookie source' do
+      Certificates.request!(source: :session_cookie)
+
+      expect(Certificates.ttl(source: :session_cookie)).to be > 3600
+    end
+  end
+end

data/spec/firebase_id_token/configuration_spec.rb

@@ -16,12 +16,6 @@ module FirebaseIdToken
       end
     end
 
-    describe '.redis' do
-      it 'sets a Redis instance as default' do
-        expect(Configuration.new.redis).to be_a(Redis)
-      end
-    end
-
     describe '.redis=' do
       it 'changes default values' do
         config = Configuration.new

data/spec/firebase_id_token/signature_session_cookie_spec.rb

@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+module FirebaseIdToken
+  describe Signature do
+    describe 'verifying a Session Cookie' do
+      let(:jwt) { JSON.parse File.read('spec/fixtures/files/jwt.json') }
+      let(:rsa_private) { OpenSSL::PKey::RSA.new(jwt['private_key']) }
+
+      let(:session_cookie_payload) do
+        {
+          'iss' => 'https://session.firebase.google.com/firebase-id-token',
+          'aud' => 'firebase-id-token',
+          'sub' => 'user-123',
+          'iat' => Time.current.to_i - 10,
+          'exp' => Time.current.to_i + 3600
+        }
+      end
+
+      let(:session_cookie) do
+        JWT.encode session_cookie_payload, rsa_private, 'RS256', kid: 'test'
+      end
+
+      let(:mock_certificates) do
+        allow(Certificates)
+          .to(receive(:find))
+          .with(an_instance_of(String), raise_error: false, source: anything)
+          .and_return(OpenSSL::X509::Certificate.new(jwt['certificate']))
+      end
+
+      before :each do
+        mock_certificates
+        FirebaseIdToken.configure do |config|
+          config.project_ids = ['firebase-id-token']
+        end
+      end
+
+      after :each do
+        FirebaseIdToken.reset
+      end
+
+      it 'returns the payload with type: :session_cookie' do
+        expect(described_class.verify(session_cookie, type: :session_cookie)).
+          to be_a(Hash)
+      end
+
+      it 'looks up certificates on the session cookie source' do
+        expect(Certificates).to receive(:find).
+          with(an_instance_of(String), raise_error: false,
+            source: :session_cookie).
+          and_return(OpenSSL::X509::Certificate.new(jwt['certificate']))
+
+        described_class.verify(session_cookie, type: :session_cookie)
+      end
+
+      it 'returns nil when verifying a Session Cookie as an ID Token' do
+        expect(described_class.verify(session_cookie)).to be(nil)
+      end
+
+      it 'returns nil when verifying an ID Token as a Session Cookie' do
+        expect(described_class.verify(jwt['jwt_token'], type: :session_cookie)).
+          to be(nil)
+      end
+    end
+  end
+end