Verify issuer claim (#529)

Author: tristanvanech

appengine/standard/firebase/firenotes/backend/firebase_helper.py

@@ -111,7 +111,9 @@ def verify_auth_token(request):
             request_jwt,
             public_key,
             algorithms=['RS256'],
-            audience=os.environ['FIREBASE_PROJECT_ID'])
+            audience=os.environ['FIREBASE_PROJECT_ID'],
+            issuer="https://securetoken.google.com/"
+            + os.environ['FIREBASE_PROJECT_ID'])
     except jwt.exceptions.InvalidTokenError as e:
         logging.warning('JWT verification failed: {}'.format(e))
         return None