FR: Consider making API URLs configurable

[NeoLegends]

[REQUIRED] Describe your environment

• Firebase SDK version: 5.8.3

The issue

We have a business requirement to make our web app available to customers in mainland China. As you know, the great firewall blocks Google Cloud Products if you're in China. To circumvent it, we decided to proxy Firebase through a custom domain.

• Fortunately, Firestore already exposes a setting to configure the host to connect to, so proxying this should be rather easy.
• Overriding the firebase-functions HTTPS callable URL generation is hacky & alters undocumented code, but trivial, just overwrite the function here: https://github.com/firebase/firebase-js-sdk/blob/03a4c8dbf58bab3db5742c094c91f46bbf446155/packages/functions/src/api/service.ts#L81

Doing this with other Firebase products (such as Storage or Auth), however, isn't that simple. If there was a way to customize the rest of the SDKs URLs, we'd be able to use Firebase in mainland China with only a little bit of additional effort (which I'm fine to bear by myself).

WDYT? I'm fine sending a PR implementing this.

[abdifardin]

@NeoLegends I have same problem in Iran. Could you please let me know if you have a solution and share it with me

I tried to host all firebase queries on cloud functions and call them with proxied URL But as you noted auth and storage do not work with this solution

[huiyifyj]

The great firewall blocked firebase realtime databse (can't visit to *.firebaseio.com) last year in China. But don't block domain about Authentication *.firebaseapp.com now.

So, can't connect storage and realtime database normally in China. But can visit to website that was deployed on the firebase hosting now.

And I hope can add proxy configuration.

[peppesilletti]

Hello @NeoLegends, I'm having the same issue. Did you manage to solve the problem eventually?

[NeoLegends]

No, not yet.

[peppesilletti]

No, not yet.

That's too bad! I was wondering, regarding the auth service, would it be fine to just create a proxy service that will intercept the auth requests and forward them to firebase, returning the result to the client?

[NeoLegends]

This is the goal of making the URLs configurable. However, due to the current political issues regarding China (and perhaps also Iran) I figure there won't be any official solution for this anytime soon.

[peppesilletti]

This is the goal of making the URLs configurable. However, due to the current political issues regarding China (and perhaps also Iran) I figure there won't be any official solution for this anytime soon.

What I mean is, creating a proxy service that runs outside of China of course, and forward all the auth requests to firebase, maybe creating a session on the proxy server for the client based on the auth results. So you don't really need to change the URL in the end.

[NeoLegends]

How are you going to point the firebase auth library to your server?

[peppesilletti]

How are you going to point the firebase auth library to your server?

Let's see, what I'd do is:

1. On the proxy service, using the firebase SDK
2. Disable auth persistence with firebaseClient.auth().setPersistence(firebaseClient.auth.Auth.Persistence.NONE)
3. Authenticate the user with firebaseClient.auth().signInWithEmailAndPassword(email, password)
4. Get the authenticated userId Token with user.getIdToken()
5. Create a session cookie with firebaseAdmin.auth().createSessionCookie
6. Set a cookie on the client that can be used with each request

In another words, I'd just create a wrapper around the Firebase SDK. I'm probably missing something, I'm not a Firebase expert :) Curios to hear your opinion about it!

[NeoLegends]

Good point, this may work! I think we have considered doing something like this also, but overthrew the idea, because it would only allow using the auth library. Firebase, Firestore, etc. would still try to contact the servers in the usual way, I think. I'd like to be proven wrong, though. :)

[peppesilletti]

Good point, this may work! I think we have considered doing something like this also, but overthrew the idea, because it would only allow using the auth library. Firebase, Firestore, etc. would still try to contact the servers in the usual way, I think. I'd like to be proven wrong, though. :)

I'll let you know, I'm just working on a solution for this problem with a client : )

[pangia]

and then....?? :)

[Rush]

This would be really useful. Also planning to set up a firebase proxy like some of the commenters here. One thing I'm considering is forking the client library if needed...

[florianmonfort]

This would be really useful. Also planning to set up a firebase proxy like some of the commenters here. One thing I'm considering is forking the client library if needed...

We have tried the forking way and have stumbled upon one challenge which is that upon installation of the Analytics SDK seems to be automatically retrieving additional code from Google's servers directly which then also contain the URLs from Google, so we can't touch those.

Just for clarification I am referring to Firebase Analytics SDK part here.

Have you had any success making this method work?

[treeder]

@NeoLegends any chance you figured out how to do do this with auth?

[NeoLegends]

No, I'm afraid a fork is the only way to go.

Since this topic would be touching export restrictions and embargoes that are currently in place by the US government I still suspect we won't see any official solution soon.

[florianmonfort]

No, I'm afraid a fork is the only way to go.

Since this topic would be touching export restrictions and embargoes that are currently in place by the US government I still suspect we won't see any official solution soon.

I'm guessing so as well, so we just went the fork way and made our own version of it.

[Rush]

I have a fix without forking. I'm replacing some URLs with webpack. PM me for exact solution.

[michalzaq12]

@Rush Could I reveal what URLs you changed and how?

[Rush]

@Rush Could I reveal what URLs you changed and how?

No, Clearly Google didn't want this to be public knowledge.