Firebase Authentication sharing between domain and subdomain

user_634704 0
Viewed 352

I have two websites created using Flutter.

One website is deployed on the main domain and another website is deployed on the sub-domain of main domain where first site is already deployed.

Both websites are using the same Firebase Project so, the Authentication detail and user base is same for both.

What I wanted to achieve is like when user login on one website, he doesn't need to log in on another website. Another website just detects it as an already logged-in user. This is kind of Single sign.

I went through firebase documentation but didn't get any guidance on how to achieve it. The custom token could be a way to achieve it but I am afraid that it could make authentication complicated.

Any pointer or guidance would be appreciated.

flutter-web firebase-authentication firebase
1 Answers

The easiest way would be to use Firebase Session Cookies. When the user logs in, call a Cloud Function (or your server) and use the Admin SDK to generate a session cookie using createSessionCookie() method. Then you can set the cookie on .domain.tld and the cookie can be access from all of your sub-domains.

However, this means you may have to serve all your request through a Cloud Function or a server since you cannot use Firebase Security Rules (unless the user is still logged in with Firebase SDK) along with session cookies. The cookie must be validated at server side before serving the resources.

One work around could be checking if a user is logged in on sub-domain via Firebase SDK. If not then check if that session cookies which was added when user first logged on to the root domain exists. If the cookie is present then generate a custom token and sign in user via Firebase SDK using custom token if not then redirect user to log in page.

user_131306970
Related