I'm using Firebase Auth with multiple web applications. To control sign in, I'm setting up a beforeSignIn Blocking Function to allow or disallow a sign in. The criteria on whether to allow the sign in depends on which web application the user is trying to sign in to. Is there a way to pass custom metadata from the web application to the blocking function so the blocking function can apply logic based on it? The EventContext argument doesn't seem to allow for this, except maybe the customizable locale parameter:
It would be quite hacky, but I suppose I can stuff the application identifier in locale to identify the web app using the Client SDK (although I'm not sure yet how to do that yet), but this seems like an inappropriate use of the locale argument.
Note: I realize that passing custom metadata from the client can easily be spoofed, so I'm not relying on this to be a security feature (just a user convenience feature). In other words, even if the user signed in when s/he shouldn't have, no harm no foul.