firebase / firebase/firebase-tools

Add a warning when auth emulator URI is set to `localhost`

Open
#6,462 3 comments 0 reactions 0 assignees View on GitHub
emulators: auth type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### [REQUIRED] Environment info

**firebase-tools:** 12.7.0

**Platform:** Windows 10

### [REQUIRED] Test case

Any program which uses Firebase Auth, with the authentication emulator. My test case is here:

https://github.com/colohan/firebaseauth

### [REQUIRED] Steps to reproduce

1. Run "firebase emulators:start".
2. Open the hosting emulator at http://127.0.0.1:5000 (using the link provided in a convenient table by the firebase emulator, if you like).
3. Click "click to sign in". This will use signInWithRedirect() to redirect you to the auth emulator at http://localhost:9099/emulator/auth/handler (with more params on the URL).
4. Click "+ Add new account", then click "Auto-generate user information", then click "Sign in with Google.com".
5. The emulator code will redirect you back to 127.0.0.1:5000
6. Notice that even though you just logged in -- you are not logged in.
7. Got to step 3, in an infinite loop.

### [REQUIRED] Expected behavior

You get signed in.

### [REQUIRED] Actual behavior
[firebase-debug.log](https://github.com/firebase/firebase-tools/files/13049256/firebase-debug.log)

You get an infinite loop, and are never signed in.

I'll include the logs, but the auth emulator doesn't appear to log anything, so I suspect they are useless.

[firebase-debug.log](https://github.com/firebase/firebase-tools/files/13049261/firebase-debug.log)

Analysis:

The actual problem: the emulator prompts you to go to 127.0.0.1:5000 in the command line output. But when you invoke signInWithRedirect(), it redirects you to localhost -- which the browser doesn't believe is the same as 127.0.0.1. So when you log in on localhost, and the emulator redirects you back to 127.0.0.1:5000, then sessionStorage is cleared, and your login session is lost.

There are three potential fixes to this issue that I can see:

1. Change the emulator command line to instruct the user to open http://localhost:5000 instead of http://127.0.0.1:5000. This fixes the problem if you do this. (It took me an embarrassingly long time to figure this out.)
2. Change the signInWithRedirect() to connect to the emulator through 127.0.0.1 instead of localhost, if that is what the user has already opened (I *think* this will work, but have not tested this change).
3. Identify some config option I've screwed up which is causing me to enter this bad edge case, and document it better or warn the user when they mess it up like I apparently did?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.