Firebase Authentication Patterns
Firebase Authentication patterns covering session cookies, custom claims, RBAC, Next.js App Router integration, token verification, and secure authentication flows.
- Difficulty
- intermediate
- Read time
- 1 min read
- Version
- v1.0.0
- Confidence
- established
- Last updated
Quick Reference
Firebase Auth: Use session cookies for SSR (5min-2weeks expiry). Verify tokens server-side with Admin SDK. Custom claims for RBAC (set server-side only, max 1000 bytes). Force token refresh after claim changes. Multi-layer protection: DAL, route, UI, server actions. Don't rely on middleware alone for auth (CVE-2025-29927).
Use When
- Firebase authentication implementation
- Next.js with Firebase
- Role-based access control
- Server-side authentication
Skip When
- Non-Firebase auth providers
- Static sites without auth
Firebase Authentication Patterns
Firebase Authentication patterns covering session cookies, custom claims, RBAC, Next.js App Router integration, token verification, and secure authentication flows.