InvalidAuthBlockingTokenError (wrong audience) when using blocking function with Firebase emulators

[fediazgon]

Hi! I have defined the following function:

from firebase_functions import identity_fn, https_fn


@identity_fn.before_user_created()
def on_request_example(
        event: identity_fn.AuthBlockingEvent,
) -> identity_fn.BeforeCreateResponse | None:
    print("Hello World")
    return None

When running Firebase emulators (auth and functions). I see that in the logs the functions is deployed correctly:

functions Loaded functions definitions from source: on_request_example.

However, when I trigger a user creation with:

curl -s -X POST \
    "http://localhost:9099/identitytoolkit.googleapis.com/v1/accounts:signUp?key=any" \
    -H 'Content-Type: application/json' \
    -d '{"email": "[email protected]", "password": "1234567"}'

I get the following stack trace in the emulator window:

>  --- Logging error ---
>  Traceback (most recent call last):
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/_identity_fn.py", line 322, in before_operation_handler
>      decoded_token = _token_verifier.verify_auth_blocking_token(jwt_token)
>                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 209, in verify_auth_blocking_token
>      get_app()).verify_auth_blocking_token(auth_blocking_token)
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 198, in verify_auth_blocking_token
>      return self.auth_blocking_token_verifier.verify(
>             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/home/fediazgon/llm-retrieval/backend/functions/venv/lib/python3.11/site-packages/firebase_functions/private/token_verifier.py", line 130, in verify
>      raise self._invalid_token_error(error_message)
>  firebase_functions.private.token_verifier.InvalidAuthBlockingTokenError: Firebase Auth Blocking token has incorrect "aud" (audience) claim. Expected "run.app" but got "http://127.0.0.1:5001/llm-retrieval/us-central1/on_request_example". Make sure the Auth Blocking token comes from the same Firebase project as the service account used to authenticate this SDK. See https://cloud.google.com/identity-platform/docs/blocking-functions for details on how to retrieve Auth Blocking token.

This same example works with v1 functions and the node SDK (I haven't tried with v2 node SDK). I also made sure to set the GOOGLE_APPLICATION_CREDENTIALS, GCPROJECT and FIREBASE_AUTH_EMULATOR_HOST as is described in other issues.

I'm using firebase-tools = 12.5.4 and firebase-functions = 0.1.0.

Also, the reason I'm using curl to create a user is that, if I create the user from the Firebase Emulator UI, the blocking function is not triggered (but I expect this is normal).

[fediazgon]

It seems that the functions emulator sets an env variable that allows v2 node functions to skip token verification:

• Functions emulator: https://github.com/firebase/firebase-tools/blob/6e9f56ea7ae7a860b8f3876f694fa429206b179d/src/emulator/functionsEmulator.ts#L1190
• Firebase functions (node): https://github.com/firebase/firebase-functions/blob/3e7a4b77967e46a067712445c499c5df005b8e31/src/common/providers/identity.ts#L800)
  I guess there should be a similar feature for Python.

I don't mind fixing this since it seems like a very localized issue.

[fediazgon]

I can confirm that this works with v2 functions written in TS.

[exaby73]

Hey @fediazgon. I was looking into #133 and I believe you are experiencing the same issue. This may not be an issue with the Python SDK, but I still need to do some more investigating. I'll keep you updated on the progress on the other issue and I'll close this one to dedupe it. Please comment if you disagree with my decision to close this issue. Thank you

[joaqo]

I am experiencing the same issue. This is an issue with the local emulator, so I don't think the issue you mentioned @exaby73 is related. I think this issue should be re-opened.

@fediazgon did you end up finding a way to get around this issue?

[exaby73]

@joaqo The issue I mentioned, after testing that one, the crash mentioned is the same one here, therefore I deduped it

[joaqo]

@exaby73 The issue you mentioned and this one are both related to authentication, but they are different, deduplicating is not the correct course of action.

[exaby73]

@joaqo #145 Will fix both these issues