Firebase ID token is too long and exceeds header max size

Question

I'm working at a company that uses Firebase cloud functions on the backend with NodeJS and we have had a specific issue with one single user: his token exceeds 7 000 characters.

Every time a user logs in we take their ID token on the frontend and set a header property on an axios instance for that token, that axios instance points to an API of ours which will use that Firebase token to authenticate users like in:


const setAPIHeader = (header, value) => {
    // axiosCustomApis: a list of Axios instances pointing to multiple APIs
    axiosCustomApis.map((api) => {
        api.defaults.headers.common[header] = value
    });
}

firebase.auth().onAuthStateChanged((user, error) => {
    if (!firebase.auth().currentUser) return;
    
    firebase
        .auth()
        .currentUser.getIdToken(true)
        .then((token) => {
            setAPIHeader("firebase-token", token)
        })
})

This user is able to log in correctly, however, every time he uses one of our services provided by the APIs and which depend on this token, he receives an error status of 400.

We found that his request doesn't even make it to the backend, so the 400 wasn't sent on purpose/due to internal API errors.

When I test with tokens from other logged in users or without a token, I get the expected behavior: the user is forced to relogin.

When I test with small fake tokens, I also get the expected behavior: being forced to relogin.

However, if I test with a fake token, but with the same number of characters as his, I get the same problematic result: 400.

And, I ended up noticing that his tokens are always ridiculously bigger: normally ours are 3k characters long, his tokens are 7k.

The maximum header size as defined by the backend is 8192 bytes (Node version: 10.19.0), so this is possibly the problem.

I tried to increase this limit, for that, I put the following code to check if there was any change:

const http = require("http");
...
console.log(`Max HTTP Header size is ${http.maxHeaderSize}`));

And, I tried, in the React application:

// package.json

"start": "set HTTPS=true && node scripts/start.js --max_old_space_size=16000" // from 8192 to 16000

In the Node APIs:

// package.json
"serve": "npm run watch & firebase serve --port 5000 --max-http-header-size=16000 --only functions",

Nothing of this changed the max header size.

I'd like to know about two possible solutions: How to increase the header max size in a Firebase application and what could be causing a user's token to be this size.

user_18265570 · Answer

You are using node version: 10.19.0,node version less than 14 has maximum header size of 8kb. Update your node version to 14 or more and you can update header size using below code

 node --max-http-header-size=1600 server.js

Or you can achieve same by setting the value on NODE_OPTIONS as mentioned in this github thread

what could be causing a user's token to be this size.

Firebase ID Token lengths depends on the exact information included in the token such as user's name, uid, some other profile and authentication related information and other custom claims.

Firebase ID token is too long and exceeds header max size

1 Answers