Firebase 3.x Server-side API

[Nick Collins]

Man, IMHO the new server-side APIs blow! They have all but completely removed any of the server-side authentication APIs, limiting it only to being able to generate a token. No more can you create a user, or authenticate a user mixing the Firebase API with your own logic hidden on the server. Not a fan...

[Daniel Zuidinga]

Are you sure? On Hacker News they've said that the API is backward compatible?

[Jacob Wenger]

@Nick -

I'm really sorry to cause you frustration here! For those who aren't sure what Nick is referring to, we've removed all of the methods for authenticating anonymously, with email / password, and with OAuth tokens in the 3.0.0 server SDK release. We've also removed the user management methods. These changes have been called out explicitly in our release notes.

On the authentication front, you still can get fine-grained control over what the auth variable ends up as in your Security Rules by using the new databaseAuthVariableOverride option when initializing your app. You can read about how to use that here. You also can pass the auth JWT from the new 3.0.0 clients to your backend, verify and decode it with verifyIdToken(), and then create a new FirebaseApp instance with databaseAuthVariableOverride set to { uid: <uid_from_decoded_token> } to simulate reads and writes as that user.

As for the user management methods, there is currently no replacement. And I agree that this is less than ideal. Some features / use cases had to be cut for the 3.0.0 release and this was one of them. This is an intentional decision on our part and we realize that there are some legitimate use cases for the existing APIs. However, we have long planned to create a full admin auth API for our server SDKs. The changes we made in 3.0.0 put us in a place where we can make that a reality.

An important thing I want to say is that you do not have to upgrade to the latest SDK. The existing SDKs continue to work and are not going to stop working any time soon. We will be updating the Node.js and Java SDKs over the coming weeks and months and will bring you the features that you need. Until then, if you cannot upgrade, hang tight and keep an eye out on our release notes.

I'd love to hear more about your use case and see how we can prioritize things to make sure you are no longer blocked. If you'd be willing to chat, please email me at ja...@firebase.com and I'll set aside some time for us to discuss. We are all in this together and I'd love to hear your thoughts on if and where the new SDK lags behind the old one.

@Daniel - The new 3.0.0 SDKs are not backwards compatible. That is why we bumped the major version - because the SDK release contains breaking changes. What I (or my teammate) meant by backwards compatible is that all of the existing SDKs that you are using in your live apps will continue to work. If you did not do anything to upgrade your code, your apps will continue to work. Even if you migrate to the new console, your apps will continue to work. If you decide to upgrade the SDK though, you will need to check out the migration guide to work through the breaking changes.

Cheers,

Jacob

[Steffen Frost]

@Jacob, If I have a working iOS and Javascript app running on v2.5.1, will the javascript web app still work if I upgrade to v3.0.0?

[Jacob Wenger]

No, it will not. The 3.0.0 version of the JavaScript SDK introduces breaking changes. If you decide to upgrade the SDK, you will need to check out the migration guide to work through the breaking changes. Simply upgrading the version number will not be enough.

Jacob

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/cc8dcad0-9b88-47e2-8cca-250c26a9ac8e%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.