Missing permission for Firestore with Firebase 8.0.1 #4050

ghivert · 2020-11-08T13:25:19Z

Describe your environment

Operating System version: macOS 10.15.7
Browser version: Chrome 86.0
Firebase SDK version: 8.0.1
Firebase Product: Authentication + Firestore

Describe the problem

I just upgraded Firebase from v7.21.0 to v8.0.1 and spotted a bug on Firestore. When creating a user, I’m creating a custom claim for the user. In my Firestore Rules, I’m using the custom claim to enable access. The first time I’m querying Firestore, I receive a Missing permission. After reloading the page, the exact same code loads without issue. The issue is not there on 7.21.0.

Steps to reproduce:

Set a custom claim right after creating user with email and password, and then try loading a document from Firestore with the custom claim as condition.

Relevant Code:

Those are extracts from my configurations with names changed.

match /example/{eid} {
  allow read: if
    eid in request.auth.token &&
    request.auth.token[eid] != null;
  allow update: if false;
  allow write: if false;
}

// backend part
const user = await admin.auth().getUser(id)
const customClaims = user.customClaims || {}
await admin.auth().setCustomUserClaims(id, {
  [example.id]: 'member',
  ...customClaims,
})

// frontend part
const query = async () => {
  try {
    await user.getIdTokenResult(true)
    return await firestore.collection('example').doc(example.id).get()
  } catch (error) {
    return query()
  }
}
query()  // This raise an issue. Then after reload it works.

The text was updated successfully, but these errors were encountered:

ghivert · 2020-11-09T11:11:21Z

I wanted to confirm the bug while enjoying the new emulators, so I tried different version: the bug is present on v8.0.1 but not on v8.0.0.

The exact error message:

FirebaseError: Missing or insufficient permissions.
    at new Nr (http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:45522)
    at http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:169449
    at cf.onMessage (http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:170279)
    at http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:168331
    at http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:168736
    at http://localhost:3000/__/firebase/8.0.1/firebase-firestore.js:1:113756

I’m using the emulator to get the Firebase SDK, so my index.html is as follows:

<html>
  <!-- Things here… -->
  <body>
    <!-- Other things here… -->
    <script src="/__/firebase/8.0.1/firebase-app.js"></script>
    <script src="/__/firebase/8.0.1/firebase-auth.js"></script>
    <script src="/__/firebase/8.0.1/firebase-firestore.js"></script>
    <script src="/__/firebase/8.0.1/firebase-storage.js"></script>
    <script src="/__/firebase/8.0.1/firebase-functions.js"></script>
    <!-- <script src="/__/firebase/8.0.1/firebase-analytics.js"></script> -->
    <script src="/__/firebase/8.0.1/firebase-performance.js"></script>
    <script src="/__/firebase/init.js"></script>
  </body>
</html>

sam-gc · 2020-11-09T19:03:29Z

Hi, thanks for filing this.

Are you seeing this bug only when interacting with the emulators, or is it happening in production as well?

ghivert · 2020-11-10T11:54:34Z

Hi,

It’s happening with the emulators and with a production release when switching from v8.0.0 to v8.0.1

sam-gc · 2020-11-12T16:47:12Z

Okay, thanks. Another question (trying to determine if this is on the Auth side or the Firestore side): if you inspect the results of await user.getIdTokenResult(true), do you see your custom claims in the claims field?

ghivert · 2020-11-13T10:04:05Z

Yes, the await user.getIdTokenResult(true) shows properly my [example.id]: 'member' claim, so the backend is running smoothly. Do you need a small reproducible bug (I can try to do it, but not now), or is it enough for you?

thebrianchen · 2020-11-18T16:47:39Z

@ghivert I tried reproducing this at v8.0.1, but it seemed to work for me. How are you splitting the backend and frontend functionality in your code? Could you please provide a small repro?

google-oss-bot · 2020-11-25T02:02:15Z

Hey @ghivert. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

google-oss-bot · 2020-12-01T02:02:22Z

Since there haven't been any recent updates here, I am going to close this issue.

@ghivert if you're still experiencing this problem and want to continue the discussion just leave a comment here and we are happy to re-open this.

molimauro · 2020-12-01T14:40:28Z

Exact same problem unfortunately. After creating a user and setting via Cloud Functions a custom claim, the first update fails even after the firebase.auth().currentUser.getIdToken(true) (I also checked that the claims are present on the client). Instead, if I wait some seconds before calling the update, the problem is not present.
I'm using the firestore and functions emulator but not the auth one. Hope this helps, thanks!

ghivert · 2020-12-01T14:59:27Z

I can try to provide a small reproducible example, but not before next week. :(

molimauro · 2020-12-10T11:10:10Z

Same as #4175? :)

google-oss-bot added the api: auth label Nov 8, 2020

hsubox76 added the api: firestore label Nov 9, 2020

sam-gc added the needs-info label Nov 9, 2020

google-oss-bot added needs-attention and removed needs-info labels Nov 10, 2020

sam-gc added needs-info and removed needs-attention labels Nov 12, 2020

google-oss-bot added needs-attention and removed needs-info labels Nov 13, 2020

wilhuff assigned thebrianchen Nov 17, 2020

thebrianchen added needs-info and removed needs-attention labels Nov 18, 2020

google-oss-bot added the no-recent-activity label Nov 25, 2020

google-oss-bot closed this as completed Dec 1, 2020

google-oss-bot added the closed-by-bot label Dec 1, 2020

firebase locked and limited conversation to collaborators Jan 1, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Missing permission for Firestore with Firebase 8.0.1 #4050

Missing permission for Firestore with Firebase 8.0.1 #4050

ghivert commented Nov 8, 2020 •

edited

Loading

ghivert commented Nov 9, 2020 •

edited

Loading

sam-gc commented Nov 9, 2020

ghivert commented Nov 10, 2020

sam-gc commented Nov 12, 2020

ghivert commented Nov 13, 2020

thebrianchen commented Nov 18, 2020 •

edited

Loading

google-oss-bot commented Nov 25, 2020

google-oss-bot commented Dec 1, 2020

molimauro commented Dec 1, 2020

ghivert commented Dec 1, 2020

molimauro commented Dec 10, 2020

Missing permission for Firestore with Firebase 8.0.1 #4050

Missing permission for Firestore with Firebase 8.0.1 #4050

Comments

ghivert commented Nov 8, 2020 • edited Loading

Describe your environment

Describe the problem

Steps to reproduce:

Relevant Code:

ghivert commented Nov 9, 2020 • edited Loading

sam-gc commented Nov 9, 2020

ghivert commented Nov 10, 2020

sam-gc commented Nov 12, 2020

ghivert commented Nov 13, 2020

thebrianchen commented Nov 18, 2020 • edited Loading

google-oss-bot commented Nov 25, 2020

google-oss-bot commented Dec 1, 2020

molimauro commented Dec 1, 2020

ghivert commented Dec 1, 2020

molimauro commented Dec 10, 2020

ghivert commented Nov 8, 2020 •

edited

Loading

ghivert commented Nov 9, 2020 •

edited

Loading

thebrianchen commented Nov 18, 2020 •

edited

Loading