Add create session cookie feature

[stephane-ein]

Hello,

Thanks for sharing this rust library !

But it seems like we cannot create a session cookie with this library.

It should be nice to be able to create a session cookie like described in the firebase documentation : https://firebase.google.com/docs/auth/admin/manage-cookies#create_session_cookie

I created a PR to add this feature by looking at the source code of firebase-admin-node :
https://github.com/firebase/firebase-admin-node/blob/master/src/auth/auth-api-request.ts#L971
https://github.com/firebase/firebase-admin-node/blob/master/src/auth/auth-api-request.ts#L1711

Any feedback are welcome !

[davidgraeff]

Hey,

thanks for the contribution. You are using jsonwebtoken as new dependency. The current code base is using biscuit for JWT, JWS etc handling (see https://docs.rs/biscuit/0.4.2/biscuit/). I don't think it's wise to have both libraries included.

I see two options:

• Investigate if it makes sense to use jsonwebtoken instead of biscuit.
• Rework the MR to use biscuit.

Cheers, David

[stephane-ein]

Thanks for your feedback, I will look into it :)

[stephane-ein]

Hello,

I did not found a function in biscuit that enable us to generate a JWT with RSA signature from a string (like the one in jsonwebtoken)
I post an issue about it 9 days ago in biscuit repo : lawliet89/biscuit#166

Regards, Stéphane

[davidgraeff]

Thanks for the PR on biscuits repo. It seems like the maintainer is currently planning a 0.5 release and is also in summer break.

I'll have a look at the jsonwebtoken crate and if it makes sense to migrate. It isn't an option to use both crates IMO.

[JadedEvan]

FYI - I had a chance to look at the issue that @stephane-ein posted regarding biscuit. I think that we should be able to accomplish the session cookie work using biscuit and not having to use another crate to accomplish. See my comment here

[davidgraeff]

That's great. So we can actually have session cookies even with biscuit.

I want to concentrate getting the CI working again and writing more examples this week. Would come back to this MR later, if no one else does it in the mean time.

[davidgraeff]

I have finished reworking the MR. There is an example application that creates a session cookie.

But I have no idea what to do with such a cookie. Is that supposed to be used instead of an id token to perform database operations?