firebase_verify_token_dart 2.3.0

A highly performant Dart package to verify and decode Firebase Auth ID tokens (JWTs) across multiple Firebase projects using Google's public keys.

Changelog

2.3.0

• Feat: Added support for standard JWT clockSkew (leeway) to absorb minor time drifts between devices and Google's servers (defaults to 5 minutes).
• Feat: Added useNtp parameter to verify options. Skip NTP calls (useNtp = false) to verify tokens locally and synchronously in under 1ms.
• Feat: Implemented try-catch NTP failover to the local system clock so token verification never breaks offline or behind strict firewalls.
• Feat: Enhanced static verify method to support optional projectIds list arguments for thread-safe concurrent multi-tenant verification.
• Refactor: Converted FirebaseMock.fromValue to a type-safe named factory constructor with safe null fallbacks to prevent runtime TypeErrors.
• Fix: Adjusted Base64 Url decoder to correctly use base64.decode after character swaps in FirebaseJWT.
• Fix: Implemented case-insensitive search for HTTP cache-control and expires headers.
• Chore: Integrated package:flutter_lints and fixed all static analysis warnings.

2.2.0

• BREAKING: Renamed onVerifySuccessful to onVerifyCompleted.
  • The callback is now guaranteed to be called even if verification fails or an exception occurs.
• Fixed token verification to explicitly use UTC time comparisons for improved accuracy.
• Updated http, intl, and ntp_dart packages.

2.1.3

• update ntp_dart and http
• update documentation

2.1.2

• update ntp_dart
• update documentation

2.1.1

• update ntp_dart for wasm support.

2.1.0

• Accelerated token verification by integrating the ntp_dart package for precise UTC time retrieval.
• Enhanced onVerifySuccessful callback to return the verification duration in milliseconds.

2.0.3

• Improved verification speed by switching to a new API for retrieving date and time in UTC.
• Fixed verification issues with iat and authTime.

2.0.2

• Fixed date parsing karelklic: Ensured all times are correctly interpreted as UTC to avoid timezone errors.
• Improved claim date validation logic for token checks.

2.0.1

• Removed the ntp package to ensure full compatibility with WebAssembly (WASM).

2.0.0

• Improved the readability of the verify() method by introducing a dedicated helper class.
• Renamed the method getUserIdByToken to getUserID for clarity and consistency.
• The getUserID method now returns the correct value according to Google’s documentation (sub claim).
• Added the getProjectID method to extract the Firebase project ID (aud claim) from a token.
• Increased the default cache duration for accurate time resolution.
• Updated http and jose_plus packages.
• Added logging when JWT verification fails, to aid in debugging.
• Improved overall documentation for better understanding and usage of the class.
• Refactored and cleaned up the code for better performance and maintainability.

1.0.1

• Updated http package.
• Updated documentation.

1.0.0

• Replaced projectId with projectIds to support multi-project verification.
• Added the onVerifySuccessful callback function to execute code once the token is verified.
• Reduced verification times by caching Google kids and NTP.
• Updated dependencies.
• Optimized parsing algorithms.
• Clean code.
• Updated documentation.

0.0.7

• Publish package