Unable to connect to emulator over https

firebase / firebase-tools

The Firebase Command Line Tools

MIT License

3.97k stars 916 forks source link

Unable to connect to emulator over https #7290

Closed alexpchin closed 3 weeks ago

alexpchin commented 3 weeks ago

I am building a PR preview workflow where the firebase emulators are deployed to CloudRun in order to preview work before merging.

Currently, I'm using a proxy server to redirect requests to the various emulator ports from 8080. (as CloudRun is only exposing 8080).

Everything works amazing on my local machine, from localhost:8080 but when it's deployed, it's not connecting to the database? The auth is working and I'm seeing tokens returned etc. However, I can't make a connection to the db. I believe it's to do because I'm accessing from an https endpoint.

To easily replicate the issue:

Start the emulator, then run ngrok:

ngrok http 8080

Try to view the emulator via https, and you'll see that you can't connect to the database.

alexpchin commented 3 weeks ago

I can see some code that seems to be relevant in ExpressBasedEmulator that seems to reference:

Enables accessing locahost when site is exposed via tunnel see https://github.com/firebase/firebase-tools/issues/4227

However, there is no documentation?

joehan commented 3 weeks ago

Hey @alexpchin, unfortunately, I think you are caught up in an infrastructure mismatch here.

The emulator suite does not support HTTPS, because it is not meant to be run as a remote server, and supporting HTTPS well is quite tricky in our case. Any requests to it should come through HTTP (hence your reverse proxy)
Because of this, the Firebase SDKs disable SSL when connecting to the Firestore emulator (https://github.com/firebase/firebase-js-sdk/blob/master/packages/firestore/src/lite-api/database.ts#L316)
Cloud Run only allows HTTPS and automatically pushes HTTP calls onto HTTPS (https://cloud.google.com/run/docs/triggering/https-request#create_public_services)

I'm not sure there is an easy workaround for you here. You could try to fork the SDK and change the SSL behavior, or choose a different solution than Cloud Run, but support for that is out of scope of this repo.

alexpchin commented 3 weeks ago

@joehan If I'm proxying the requests from https to http via a proxy server, can I not adjust the headers to satisfy be able to access firebase tools running on my container?

There seems to be a comment regarding this similar problem in the codebase as per my last comment?