Allow callable functions to skip token verification in debug mode#983
Merged
Allow callable functions to skip token verification in debug mode#983
Conversation
colerogers
approved these changes
Sep 29, 2021
Contributor
colerogers
left a comment
There was a problem hiding this comment.
lgtm, but I'd hold off merging until you get another set of eyes on it
1a51023 to
a30b2ab
Compare
8cb5e1e to
2cc7eb9
Compare
inlined
approved these changes
Oct 18, 2021
Member
inlined
left a comment
There was a problem hiding this comment.
Minor questions; still LGTM. Feedback I should have given last time though: I'm not sure if the debug flag should be about "callable" functions or just a flag to disable token checks. I feel like we'd want to disable token verification everywhere if we do it anywhere (not that I have another case in mind yet)
| * | ||
| * Do not use in production. Token should always be verified using the Admin SDK. | ||
| * | ||
| * This is exposed only for testing. |
Member
There was a problem hiding this comment.
And for debug mode/emulator, right?
Contributor
Author
There was a problem hiding this comment.
I think the comment is correct - this function will only be called internally. It will be executed in debug mode but will never be invoked directly.
taeold
added a commit
to firebase/firebase-tools
that referenced
this pull request
Oct 29, 2021
Functions SDK now includes a debug mode that can be enabled via environment variables to operate in ways that's useful during development. See firebase/firebase-functions#983 for an example. We will turn on Debug Mode and enable `skipTokenVerification` feature on the Functions Emulator. This means that callable functions will decode but not verify the signature of Auth and App Check tokens which is more or less what the monkey-patching of Firebase Functions SDK achieves. For some function triggers, we will now rely on the debug mode instead of the monkey patching to bypass the token verification.
devpeerapong
pushed a commit
to devpeerapong/firebase-tools
that referenced
this pull request
Dec 14, 2021
Functions SDK now includes a debug mode that can be enabled via environment variables to operate in ways that's useful during development. See firebase/firebase-functions#983 for an example. We will turn on Debug Mode and enable `skipTokenVerification` feature on the Functions Emulator. This means that callable functions will decode but not verify the signature of Auth and App Check tokens which is more or less what the monkey-patching of Firebase Functions SDK achieves. For some function triggers, we will now rely on the debug mode instead of the monkey patching to bypass the token verification.
kroikie
pushed a commit
to firebase/firebase-tools
that referenced
this pull request
Mar 4, 2022
Functions SDK now includes a debug mode that can be enabled via environment variables to operate in ways that's useful during development. See firebase/firebase-functions#983 for an example. We will turn on Debug Mode and enable `skipTokenVerification` feature on the Functions Emulator. This means that callable functions will decode but not verify the signature of Auth and App Check tokens which is more or less what the monkey-patching of Firebase Functions SDK achieves. For some function triggers, we will now rely on the debug mode instead of the monkey patching to bypass the token verification.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
To replace monkey-patching of the Firebase Functions SDK in the Functions Emulator (code), we provide native support for bypassing token verification for
onCallhandlers.Using the new debug mode introduced in #992, Auth/App Check token included in the request will be decoded but no verified.