- Note: I am using firebase functions “v2” (
const functions = require('firebase-functions/v2'))
So, according to several sources, which I will list at the end, it seems as though the firebase functions will automatically remove all httponly cookies sent other than __session,
There seems to be no way to control the preflight OPTIONS request to enable httopnly cookies (Access-Control-Allow-Credentials: true), since it seems that all OPTIONS requests (i.e. preflight requests) are tightly controlled by the firebase functions engine itself, and cannot be modified in the function defintiion functions.https.onRequest, as those only ever receive the POST/GET/PUT/DELETE request AFTER the preflight is handled.
What confuses me is, how is the __session cookie even sent under the hood by the official auth library for firebase? If I have the firebase function manually set the __session cookie as httponly, I have no way to send it back on the next request since if I use the fetch api with “credentials: “include”`, it will always trigger the
Request blocked by CORS policy, resposne to preflight request sent Access-Control-Allow-Credentials: '' but Access-Control-Allow-Credentials: 'true' is required for this request
(NOT an exact quote, but close enough)
So in summary
-
Does anyone know how the firebase authentication client is sending the __session cookie under the hood if the preflight request does not allow
Access-Control-Allow-Credentials: true. Is it using instead non-httponly (js accessible) cookies and sending it in a manual “Cookie: ” header from the fetch api or similar ajax? -
If I want to implement custom authentication (e.g. custom jwt protocols), should I just migrate away from firebase functions. Should I consider google cloud functions directly (as opposed ot through the firebase ecosystem) or will they have the same restriction. Is it time to move to a vps server, or use NextJS and vercel?
Supporting info:
https://firebase.google.com/docs/auth/admin/manage-cookies
Why doesn’t firebase auth support httponly cookie persistence?