firebase / firebase/firebase-functions

Don't verify auth token on public endpoints

Open
#1,557 16 comments 0 reactions 0 assignees View on GitHub
bug needs-author-feedback reproduced
Dominant language
TypeScript
Stars
1.1k
Forks
232
Avg merge
20h 46m
Merged PRs (30d)
15

Description

### [REQUIRED] Version info

**node:**

v18.19.0

**firebase-functions:**
4.9.0

**firebase-tools:**

13.5.2

**firebase-admin:**
12.0.0

### [REQUIRED] Test case

- Create a public endpoint
- Any type of endpoint will do, it can literally just return hello world
- It needs to be public

````ts
export const heartbeat = onCall(() => {
const data = {
isConnected: true,
timestamp: new Date().getTime(),
}

return data
})
````

### [REQUIRED] Steps to reproduce

- Send a request to that endpoint with a valid auth token in the `Auhtorization` header
- It should work
- Send a request to that endpoint without any token at all and no header
- It should work
- Send a request to that endpoint with an invalid auth token in the `Authroization` header
- It will reject the request

### [REQUIRED] Expected behavior
Since it's a public endpoint it should always return a response, no matter if the token is provided, valid, or invalid. I have had cases in the past where the js SDK would cause the token to become invalid and users couldn't access public endpoints anymore, one of which was a heartbeat endpoint to make sure the user is still connected.

### [REQUIRED] Actual behavior
The request is rejected when you provide an auth header with an invalid token.

### Were you able to successfully deploy your functions?
Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.