Your guide to server side authentication with Firebase
summary
Shows three concrete server-auth patterns: use callable functions (they automatically carry Firebase Auth and App Check), accept third‑party clients via Authorization: Bearer ID tokens and validate them with verifyIdToken, and enable server‑rendered sites by exchanging an ID token for a session cookie via createSessionCookie and validating with verifySessionCookie. Demonstrates Admin SDK limitations (no user impersonation), warns to enforce your own data checks, set cookie flags and expirations, and notes dynamic framework support is coming to simplify the cookie flow.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:17When to use a server
- 3:21Firebase Admin SDK
- 4:09Why is this a problem
- 5:00Callable functions
- 6:42Authorization headers
- 8:19Serverrendered websites
- 8:50Cookies
- 10:22Demo
- 12:15Summary
related talks
17mFirebase Authentication: From fully managed to fully customizable
25mFive tips to secure your app
40mThree New Ways to Secure Your App with Firebase Authentication
21mServerless security modeling in Firebase
37mBuilding simple and secure account systems on Android
12mAuthentication and Authorization in Next.js
23mIntegrating back-end systems with Firebase for better app management
13mVerifying app identity with App Check