Firestore Emulator Security Rule `request.auth` is always null even after authed

[mono0926]

[REQUIRED] Step 1: Describe your environment

• Xcode version: 11.3.1
• Firebase SDK version: 6.19.0
• Firebase Component: Auth, Firestore
• Component version: Auth: 6.19.0, Firestore: 6.19.0
• Installation method: CocoaPods

[REQUIRED] Step 2: Describe the problem

Firestore Emulator Security Rule request.auth is always null even after authed.

I tried it on Android project/emulator, and it works fine, so I suspect it is iOS SDK's bug.

Steps to reproduce:

I created the reproduced project: https://github.com/mono0926/firestore-emulator-sample

1. Prepare Firestore Emulator

Execute this:

git clone https://github.com/mono0926/firestore-emulator-sample.git
cd firestore-emulator-sample/firebase
firebase emulators:start

If you create your own Firebase project, these steps are needed:

Enable Anonymous Auth:

Enable Firestore:

2. Run iOS application

Execute this:

cd firestore-emulator-sample/iOS/ 
pod install
open EmulatorSample.xcworkspace

And Run app on iOS simulator, and push the button:

The error log will be output:

error: Optional(Error Domain=FIRFirestoreErrorDomain Code=7 "
false for 'get' @ L5" UserInfo={NSLocalizedDescription=
false for 'get' @ L5})

Relevant Code:

Security Rule

This security rule allows /users/{userId} get only if request.auth != null

https://github.com/mono0926/firestore-emulator-sample/blob/633cd0d48c8b6eaf228d1fb3f978420df1fc4e6d/firebase/firestore.rules#L5

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow get: if request.auth != null;
    }
  }
}

iOS initialization

At didFinishLaunchingWithOptions, set to connect to Firestore emulator.

https://github.com/mono0926/firestore-emulator-sample/blob/633cd0d48c8b6eaf228d1fb3f978420df1fc4e6d/iOS/EmulatorSample/AppDelegate.swift#L20-L24

        let settings = Firestore.firestore().settings
        settings.host = "localhost:8080"
        settings.isPersistenceEnabled = false
        settings.isSSLEnabled = false
        Firestore.firestore().settings = settings

iOS logic

1. Auth.auth().signInAnonymously
2. Firestore.firestore().collection("users").document(uid).getDocument()

https://github.com/mono0926/firestore-emulator-sample/blob/32f5c5bdf59eba8098c3bede21c6da430568b799/iOS/EmulatorSample/ViewController.swift#L19-L39

    @IBAction func buttonDidTap(_ sender: Any) {
        Auth.auth().signInAnonymously { (result, error) in
            assert(error == nil)
            
            guard let result = result else {
                assert(false)
                return;
            }
            
            let uid = result.user.uid
            print(uid)
            Firestore.firestore().collection("users").document(uid).getDocument { (snap, error) in
//                "snap: nil"
                print("snap: \(snap?.data())")
//                error: Optional(Error Domain=FIRFirestoreErrorDomain Code=7 "
//                false for 'get' @ L5" UserInfo={NSLocalizedDescription=
//                false for 'get' @ L5})
                print("error: \(error)")
            }
        }
    }

This should succeed without any errors because the user is authed and firestore security rule only checks request.auth != null and this condition is satisfied.

If setting to connect to emulator codes is commented out, the app will connect to real Firestore backend(same security rule deployed), and it works as expected.

[samtstern]

@mono0926 thank you for the extremely detailed bug report, this feels like a bug but I'm not sure at the moment if it's a bug in the iOS SDK or if it's a bug in the emulator(s).

[alvinthen]

Anything I can do to help further debugging this? It's a letdown not being able to test my app against the emulator suite

[logananderson]

I'm running into this issue as well. In order to test iOS against the emulator I have to change rules to allow all (allow read, write: if true;)
This unblocks local testing but not of security features, obviously.

[morganchen12]

@renkelvin can you take a moment to check if this is an SDK bug or an emulator bug?

[renkelvin]

@morganchen12 looks like an issue related to Firestore, not Auth.

[samtstern]

@renkelvin it could be related to both. Firestore needs to ask Auth for the token and Auth needs to provide one, then Firestore sends it along to the emulator and the emulator unpacks it.

I can confirm this works on Android and the Web so it's certainly something within the iOS SDK

[paulb777]

@wilhuff Any suggestions for how to debug? It's not obvious how to determine where Error::PermissionDenied gets set.

[wilhuff]

The Firestore client never sets this error code directly unless we encounter e.g. a filesystem operation with an errno that maps onto PermissionDenied (here). That doesn't seem to be what's happening in this case.

It's definitely possible that Firestore is failing to attach the credentials in some way, though this working in production but not against the emulator seems suspicious.

The best path forward is to enable debug logging in Firestore and look at all the lines relating to the current user. We log when initializing or the current identity changes.

You can observe what Firestore is sending with gRPC tracing. Set these environment variables: GRPC_TRACE=http and GRPC_VERBOSITY=DEBUG to see all the plaintext of the HTTP traffic we're actually sending. You'll see the token we're passing base64-encoded in a header like authorization: Bearer xxxyyyzzz.

Alternatively, you could set a breakpoint in Stream::ResumeStartWithCredentials (here), and observe the state of the token at the point where we're starting up the Listen RPC stream.