firebase-auth

Status : Production Ready Last Updated : 2026-01-25 Dependencies : None (standalone skill) Latest Versions : firebase@12.8.0, firebase-admin@13.6.0 CRITICAL: Custom claims are cached in the ID token. After setting claims, the user must: This skill prevents 12 documented Firebase Auth errors: Last verified : 2026-01-25 | Skill version : 1.0.0 - Go to Firebase Console > Authentication > Sign-in method - Enable desired providers (Email/Password, Google, etc.) - Configure OAuth providers with client ID/secret - Sign out and sign in again, OR - Force refresh the token with getIdTokenResult(true) - Use HTTPS in production - Required for secure cookies - Validate tokens server-side - Never trust client claims alone - Handle token expiration - Refresh before API calls - Implement rate limiting - Prevent brute force attacks - Use same error message for wrong email/password - Prevent enumeration - Enable email verification - Verify user owns email - Use session cookies for SSR - More secure than ID tokens in cookies - Revoke tokens on password change - Invalidate old sessions - Never expose private key in client code - Never trust client-provided claims - Always verify server-side - Never store ID tokens in localStorage - Use httpOnly cookies - Never disable email enumeration protection in production - Never skip CORS configuration for your domains - Firebase Auth Overview : - Web Get...