firebase / firebase/firebase-functions
Don't verify auth token on public endpoints
- Dominant language
- TypeScript
- Stars
- 1.1k
- Forks
- 232
- Avg merge
- 20h 46m
- Merged PRs (30d)
- 15
Description
### [REQUIRED] Version info
**node:**
v18.19.0
**firebase-functions:**
4.9.0
**firebase-tools:**
13.5.2
**firebase-admin:**
12.0.0
### [REQUIRED] Test case
- Create a public endpoint
- Any type of endpoint will do, it can literally just return hello world
- It needs to be public
````ts
export const heartbeat = onCall(() => {
const data = {
isConnected: true,
timestamp: new Date().getTime(),
}
return data
})
````
### [REQUIRED] Steps to reproduce
- Send a request to that endpoint with a valid auth token in the `Auhtorization` header
- It should work
- Send a request to that endpoint without any token at all and no header
- It should work
- Send a request to that endpoint with an invalid auth token in the `Authroization` header
- It will reject the request
### [REQUIRED] Expected behavior
Since it's a public endpoint it should always return a response, no matter if the token is provided, valid, or invalid. I have had cases in the past where the js SDK would cause the token to become invalid and users couldn't access public endpoints anymore, one of which was a heartbeat endpoint to make sure the user is still connected.
### [REQUIRED] Actual behavior
The request is rejected when you provide an auth header with an invalid token.
### Were you able to successfully deploy your functions?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.