Auth cookie persistence #8839

jamesdaniels · 2025-03-10T04:41:55Z

Proof-of-concept of go/firebase-auth-cookie-persistence, pair with this NextJS middleware.

Demo here—login restricted to @google.com Google accounts. Only confirmed working in desktop Chrome ATM.

Principles of operation:

New persistence option COOKIE
When persistence is cookie, sign-in and token refresh requests are proxied to /__cookie__, which is handled by the NextJS middleware. The middleware this redacts the refreshToken and stores it in an HTTP-only cookie, the idToken is stored in an JS-readable cookie
getCurrentUser() internally can accept an idToken and will initiated a fetch request to get the user-details
The NextJS middleware can itself freshen the idToken, if it's expired on a full-page load
During logout the client will set the JS-readable cookie to "" and will make a best-effort attempt to hit /__cookie__, the middleware treats the blank string as a logout and will delete the refreshToken cookie if seen

There's a lot to clean up here, some high level things that need to be addressed

For the middleware:

The middleware needs to be packaged for use in an NextJS app and released in reactfire
Drop jose in favor of WIP authIdTokenVerified #8008
Create middleware helpers to be released in @firebase/auth
Release stable express-style middleware (might not be realistic before Cloud Next)
What should the default max-age be?

changeset-bot · 2025-03-10T04:41:58Z

⚠️ No Changeset found

Latest commit: aba574a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

jamesdaniels · 2025-03-10T14:43:55Z

packages/auth/src/api/index.ts

@@ -241,6 +242,9 @@ export async function _performSignInRequest<T, V extends IdTokenResponse>(
  request?: T,
  customErrorMap: Partial<ServerErrorMap<ServerError>> = {}
 ): Promise<V> {
+  // TODO(jamedaniels) if auth persistence is cookie, proxy through the server endpoint


Could you remove the completed TODO comments from the source if they're actually done. It would help with the review.

jamesdaniels · 2025-03-10T14:44:17Z

packages/auth/src/core/user/user_credential_impl.ts

@@ -44,6 +44,8 @@ export class UserCredentialImpl
    this.operationType = params.operationType;
  }

+  // TODO(jamesdaniels) fetch the user credential from the cookie and response returned from the


jamesdaniels · 2025-03-10T14:44:33Z

packages/auth/src/model/user.ts

@@ -62,6 +62,8 @@ export interface UserInternal extends User {

  auth: AuthInternal;
  providerId: ProviderId.FIREBASE;
+  // TODO(jamesdaniels): refreshToken should either be optional or a sentinel value for COOKIE


DellaBitta · 2025-03-10T14:56:37Z

packages/auth/src/platform_browser/persistence/cookie_storage.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2019 Google LLC


DellaBitta · 2025-03-10T14:57:09Z

packages/auth/src/platform_browser/persistence/cookie_storage.ts

+export class CookiePersistence implements PersistenceInternal {
+  static type: 'COOKIE' = 'COOKIE';
+  readonly type = PersistenceType.COOKIE;
+  listeners: Map<StorageEventListener, (e: any) => void> = new Map();


I think our linter frowns up on the use of any.

DellaBitta · 2025-03-10T14:57:46Z

packages/auth/src/platform_browser/persistence/cookie_storage.ts

+  readonly type = PersistenceType.COOKIE;
+  listeners: Map<StorageEventListener, (e: any) => void> = new Map();
+
+  async _isAvailable(): Promise<boolean> {


Could you add class and method comments?

DellaBitta · 2025-03-10T14:58:29Z

packages/auth/src/platform_browser/persistence/cookie_storage.ts

+}
+
+/**
+ * An implementation of {@link Persistence} of type 'NONE'.


Isn't this of type COOKIE?

heh, yeah copy-pasta

DellaBitta · 2025-03-10T14:59:06Z

packages/rules-unit-testing/api-extractor.json

@@ -1,5 +1,5 @@
 {
    "extends": "../../config/api-extractor.json",
    // Point it to your entry point d.ts file. 
-    "mainEntryPointFilePath": "<projectFolder>/dist/rules-unit-testing/index.d.ts"
+    "mainEntryPointFilePath": "<projectFolder>/dist/index.d.ts"


Why is this change in here?

No idea, I should have left a comment this was to fix the build

DellaBitta · 2025-03-10T14:59:54Z

packages/auth/src/api/index.ts

@@ -241,6 +242,9 @@ export async function _performSignInRequest<T, V extends IdTokenResponse>(
  request?: T,
  customErrorMap: Partial<ServerErrorMap<ServerError>> = {}
 ): Promise<V> {
+  // TODO(jamedaniels) if auth persistence is cookie, proxy through the server endpoint


Could you remove the completed TODO comments from the source if they're actually done. It would help with the review.

DellaBitta · 2025-03-10T15:05:33Z

packages/auth/src/core/persistence/persistence_user_manager.ts

+      return null;
+    }
+    if (typeof blob === 'string') {
+      const response = await getAccountInfo(this.auth, { idToken: blob });


Should we check if the token is still valid and return null if it's not? We already have validateTokenTTL in app/src/firebaseServerApp.ts which could be brought into our utils package.

Have you tested this with an invalid token to see how it behaves?

Good call on both

Thinking about this, in normal operation this shouldn't happen, as the server-side route should be covered by middleware which will return set-cookie—but if the developer made a mistake and didn't cover the route with middleware then this could expire—so we should handle & log a sensible error.

DellaBitta · 2025-03-10T15:07:31Z

packages/auth/src/core/persistence/persistence_user_manager.ts

        if (blob) {
-          const user = UserImpl._fromJSON(auth, blob); // throws for unparsable blob (wrong format)
+          let user: UserInternal;


Same here, what if the token isn't valid or has expired?

jamesdaniels · 2025-03-10T15:11:49Z

packages/auth/src/core/auth/auth_impl.ts

@@ -845,6 +845,7 @@ export class AuthImpl implements AuthInternal, _FirebaseService {
  }

  async _getAppCheckToken(): Promise<string | undefined> {
+    // @ts-ignore


Should not be needed, my local build was broken without it.

hsubox76 · 2025-03-12T19:07:25Z

packages/auth/src/platform_browser/persistence/cookie_storage.ts

+  listeners: Map<StorageEventListener, (e: any) => void> = new Map();
+
+  async _isAvailable(): Promise<boolean> {
+    return navigator.hasOwnProperty('cookieEnabled') ?


Probably need a check on typeof navigator !== 'undefined' just in case. IndexedDB persistence has a check on if (!indexedDB) inside a try/catch which I think also works.

good call, will do

hsubox76 · 2025-03-12T19:21:35Z

packages/auth/src/api/index.ts

+    (path.startsWith('/v1/accounts:signIn') || path === Endpoint.TOKEN)
+  ) {
+    const params = new URLSearchParams({ finalTarget });
+    return `${window.location.origin}/__cookies__?${params.toString()}`;


I think this function can be called in Node so we may have to make sure window doesn't throw. I'm not sure if the === PersistenceType.COOKIE is a guarantee that we're in browser, maybe safer to explicitly check for window. What's the "don't use startsWith v1/accounts" comment about?

jamesdaniels added 3 commits February 25, 2025 11:39

First.

d3792b5

Merge branch 'main' into jamesdaniels_authCookiePersistence

00b0059

First.

aba574a

Sentinal as ""

8acd061

jamesdaniels commented Mar 10, 2025

View reviewed changes

DellaBitta reviewed Mar 10, 2025

View reviewed changes

jamesdaniels commented Mar 10, 2025

View reviewed changes

hsubox76 reviewed Mar 12, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth cookie persistence #8839

Auth cookie persistence #8839

jamesdaniels commented Mar 10, 2025 •

edited

Loading

changeset-bot bot commented Mar 10, 2025

jamesdaniels Mar 10, 2025

DellaBitta Mar 10, 2025

jamesdaniels Mar 10, 2025

jamesdaniels Mar 10, 2025

jamesdaniels Mar 10, 2025

DellaBitta Mar 10, 2025

DellaBitta Mar 10, 2025

DellaBitta Mar 10, 2025

DellaBitta Mar 10, 2025

jamesdaniels Mar 10, 2025

DellaBitta Mar 10, 2025

jamesdaniels Mar 10, 2025

DellaBitta Mar 10, 2025

DellaBitta Mar 10, 2025

DellaBitta Mar 10, 2025

jamesdaniels Mar 10, 2025

jamesdaniels Mar 10, 2025

DellaBitta Mar 10, 2025

jamesdaniels Mar 10, 2025

hsubox76 Mar 12, 2025

jamesdaniels Mar 12, 2025

hsubox76 Mar 12, 2025

Auth cookie persistence #8839

Are you sure you want to change the base?

Auth cookie persistence #8839

Conversation

jamesdaniels commented Mar 10, 2025 • edited Loading

changeset-bot bot commented Mar 10, 2025

⚠️ No Changeset found

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jamesdaniels commented Mar 10, 2025 •

edited

Loading