Skip to content

InvalidAuthBlockingTokenError (wrong audience) when using blocking function with Firebase emulators #143

@fediazgon

Description

@fediazgon

Hi! I have defined the following function:

from firebase_functions import identity_fn, https_fn


@identity_fn.before_user_created()
def on_request_example(
        event: identity_fn.AuthBlockingEvent,
) -> identity_fn.BeforeCreateResponse | None:
    print("Hello World")
    return None

When running Firebase emulators (auth and functions). I see that in the logs the functions is deployed correctly:

functions Loaded functions definitions from source: on_request_example.

However, when I trigger a user creation with:

curl -s -X POST \
    "http://localhost:9099/identitytoolkit.googleapis.com/v1/accounts:signUp?key=any" \
    -H 'Content-Type: application/json' \
    -d '{"email": "fediazgon@gmail.com", "password": "1234567"}'

I get the following stack trace in the emulator window:

>  --- Logging error ---
>  Traceback (most recent call last):
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/_identity_fn.py", line 322, in before_operation_handler
>      decoded_token = _token_verifier.verify_auth_blocking_token(jwt_token)
>                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 209, in verify_auth_blocking_token
>      get_app()).verify_auth_blocking_token(auth_blocking_token)
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 198, in verify_auth_blocking_token
>      return self.auth_blocking_token_verifier.verify(
>             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 130, in verify
>      raise self._invalid_token_error(error_message)
>  firebase_functions.private.token_verifier.InvalidAuthBlockingTokenError: Firebase Auth Blocking token has incorrect "aud" (audience) claim. Expected "run.app" but got "http://127.0.0.1:5001/llm-retrieval/us-central1/on_request_example". Make sure the Auth Blocking token comes from the same Firebase project as the service account used to authenticate this SDK. See https://cloud.google.com/identity-platform/docs/blocking-functions for details on how to retrieve Auth Blocking token.

This same example works with v1 functions and the node SDK (I haven't tried with v2 node SDK). I also made sure to set the GOOGLE_APPLICATION_CREDENTIALS, GCPROJECT and FIREBASE_AUTH_EMULATOR_HOST as is described in other issues.

I'm using firebase-tools = 12.5.4 and firebase-functions = 0.1.0.

Also, the reason I'm using curl to create a user is that, if I create the user from the Firebase Emulator UI, the blocking function is not triggered (but I expect this is normal).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions