Cross-Domain Firebase Authentication: A Simple Approach
Tags: googlecloud, firstpost, firebase, authentication
Published: 2021-02-15 08:24:26

If you're reading this you've probably just discovered that Firebase Auth only authenticates for a single domain, yet you need to share that authentication across domains and subdomains and not sure where to start.

I was in the same boat and discovered [one developer's approach](https://dev.to/johncarroll/how-to-share-firebase-authentication-across-subdomains-1ka8) that helped to point me in the right direction.  Here is a simpler approach that's just as secure but with less plumbing and allows the user to authenticate through any of your subdomains.

##How Does it Work?

####I. Initial Authentication

![Firebase Auth Step 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xyqme1cvdl23zd5emudk.png)

1. First the user authenticates using Firebase Auth to obtain an ID Token on the client side on any subdomain.  For this example the user authenticates through `app1.domain.com`.

2. The user then sends that ID Token via POST to the Cloud Functions endpoint `/auth/login` on the same subdomain, `app1.domain.com`.

3. The Firebase Hosted website rewrites `/auth` to the `AuthFunction` Cloud Function.

4. `AuthFunction` takes the ID token, verifies it using `verifyIdToken()` and then calls `createSessionCookie()` and assigns that value to the `__session` cookie with the domain `.domain.com` giving it access to all of the subdomains of the requesting domain.  The cookie should have `httpOnly=true`, `secure=true` and `sameSite=strict` set.

*Note: `__session` is the only cookie name that Firebase Hosting allows you to use. Any other cookies get stripped. [Source](https://firebase.google.com/docs/hosting/manage-cache#using_cookies)*

####II. Cross-Domain Authentication

![Firebase Auth Cross-Domain Authentication](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fi16h943bz01en3npw7y.png)

1. Assume the user is now authenticated on `app1.domain.com` but we need the user to be authenticated on `app2.domain.com`.  First the user checks if it's authenticated with Firebase Auth client side, then it makes a `GET` request to `https://app2.domain.com/auth/status`.

2. The Firebase Hosted website rewrites `/auth` to the communal `AuthFunction` Cloud Function.

3. The `/auth/status` endpoint checks for the existence of the `__session` cookie, then validates the session cookie value with `verifySessionCookie()`.  If valid it calls `createCustomToken(<uid>)` and returns the custom token to the client.  If not it returns a 401 error and clears the `__session` cookie.

4. If a `200` status code is returned, the client takes the custom token and calls Firebase's `signInWithCustomToken()` passing the custom token. Now the user is authenticated on `app2.domain.com`.
If a `401` status code is returned, the client logs out through Firebase Auth and is sent to the login page.

##Destroying a Session

Finally when a user logs out, the `/auth/logout` endpoint should be called to perform two actions:

1. Clear the `__session` coookie.

2. Optionally call `revokeRefreshTokens(<uid>)` to revoke all tokens for that user across all devices.  Otherwise if you want to revoke authentication on a single device you'll need to monitor for the presence of the `__session` cookie and if it vanishes the user should be logged out using Firebase Auth.  The latter requires that the cookie's `httpOnly` property is set to `false`.

---

To be continued with code examples.