Skip to main content
Cloud firebase recommended

Firebase Authentication Patterns

Firebase Authentication patterns covering session cookies, custom claims, RBAC, Next.js App Router integration, token verification, and secure authentication flows.

Difficulty
intermediate
Read time
1 min read
Version
v1.0.0
Confidence
established
Last updated

Quick Reference

Firebase Auth: Use session cookies for SSR (5min-2weeks expiry). Verify tokens server-side with Admin SDK. Custom claims for RBAC (set server-side only, max 1000 bytes). Force token refresh after claim changes. Multi-layer protection: DAL, route, UI, server actions. Don't rely on middleware alone for auth (CVE-2025-29927).

Use When

  • Firebase authentication implementation
  • Next.js with Firebase
  • Role-based access control
  • Server-side authentication

Skip When

  • Non-Firebase auth providers
  • Static sites without auth

Firebase Authentication Patterns

Firebase Authentication patterns covering session cookies, custom claims, RBAC, Next.js App Router integration, token verification, and secure authentication flows.

Tags

firebase authentication security next.js react rbac

Discussion