firebase-functions: onCall function returning cors on web and "UNAUTHENTICATED" on mobile

[REQUIRED] Version info

"firebase-admin": "8.0.0",
"firebase-functions": "3.3.0", // have tried "firebase-functions": "3.5.0",
"firebase-tools": "7.0.0", // have tried "firebase-tools": "7.16.1",

node:

"engines": {
  "node": "8" // have tried "node": "10"
},

[REQUIRED] Test case

node:

export const cheerCommunityDiscussionMessage = functions
  .region("europe-west2") // have tried us-central1 default
  .https
  .onCall((data, context) => {
    return Promise.resolve({ success: true })
  })

web:

const firebase = firebase.initializeApp({ ... })
const cheerCommunityDiscussionMessage = firebase
  .app()
  .functions("europe-west2") // have tried us-central1 default
  .httpsCallable("cheerCommunityDiscussionMessage");

return cheerCommunityDiscussionMessage({ messageId: 'test' })

react-native-firebase

const cheerCommunityDiscussionMessage = firebase
  .app()
  .functions('europe-west2') // have tried us-central1 default
  .httpsCallable('cheerCommunityDiscussionMessage');

return cheerCommunityDiscussionMessage({ messageId: 'test' })

[REQUIRED] Steps to reproduce

deploy function
call function from web
call function from react-native using react-native-firebase library

[REQUIRED] Expected behavior

The function should return { success: true } as it does in the cloud function test below:

[REQUIRED] Actual behavior

On mobile the function returns a “UNAUTHENTICATED” error and on web it returns a CORS error. There are no logs firebase which i guess means the function is never reached.

p.s. almost identical functions deployed more than 4 days ago are working fine

Were you able to successfully deploy your functions?

successfull deploy no errors

About this issue

Original URL
State: closed
Created 4 years ago
Reactions: 9
Comments: 41 (10 by maintainers)

Links to this issue

firebase hosting blocking script due to CORS issue - Stack Overflow

Most upvoted comments

Manual instructions from the tutorial linked by @todorone:

1. Go to the Google Cloud Console: https://console.cloud.google.com/functions/

2. Click the checkbox next to the function on which you want to grant access.

3. Click Show Info Panel in the top right corner to show the Permissions tab.

4. Click Add member.

5. In the New members field, type allUsers.

6. Select the role Cloud Functions > Cloud Functions Invoker from the Select a role drop-down menu.

7. Click Save.

Note: As of January 15, 2020, HTTP functions require authentication by default. You can specify whether a function allows unauthenticated invocation at or after deployment. - this note is posted above the instructions in the tutorial. Anyone know if its possible to do as part of firebase deploy or if it’s supposed to happen automatically?

+98

alexstroukov on Mar 30, 2020

Hey everybody, there is an update from support. The issue is probably with GCloud functions permissions not set for Cloud Functions Invoker -> allUsers. Please follow the instructions and let me know if it helped - https://cloud.google.com/functions/docs/securing/managing-access-iam#allowing_unauthenticated_function_invocation

+16

todorone on Mar 30, 2020

The Firebase CLI ought to be automatically adjusting IAM to allUsers for functions it creates. If that’s not happening, it’s a bug. We’ll investigate.

+10

mbleigh on Mar 30, 2020

I’m using Firebase auth and still get ERROR UNAUTHENTICATED. @jbohman method is the only way to fix this. After use his method, i check the context argument and boom, it got all the auth info. This is surely a bug in firebase functions.

Firebase-tools 8.4.2 react-native-firebase:5.6.0

IOS Pod Firebase 6.13.0 FirebaseFunctions (2.5.1)

kkusanagi on Jun 7, 2020

Have a similar situation, interesting that I have 2 firebase projects - staging and production, and while the same functions work perfectly on one of firebase projects, they throw Error: UNAUTHENTICATED on another one.

UPDATE: Another super-strange fact - some of the functions being executed, and some are not, functions started to deploy 1.5x faster then yesterday, maybe deployment system was upgraded that resulted in issues?

todorone on Mar 27, 2020

So I’ve run into this issue as well, tried firebase-tools version 7.16.0, 7.16.2 and 8.0.0 and same result. I’m the owner of the firebase project.

When I run with debug flag I see this (with version 8.0.0):

[2020-04-02T05:55:42.229Z] Setting public policy for function organiserActions
[2020-04-02T05:55:42.230Z] >>> HTTP REQUEST POST https://cloudfunctions.googleapis.com/v1/projects/hidden-project/locations/us-central1/functions/organiserActions:setIamPolicy
 {"policy":{"version":3,"bindings":[{"role":"roles/cloudfunctions.invoker","members":["allUsers"]}]},"updateMask":"version,bindings"}
[2020-04-02T05:55:42.846Z] <<< HTTP RESPONSE 200 {"content-type":"application/json; charset=UTF-8","vary":"X-Origin, Referer, Origin,Accept-Encoding","date":"Thu, 02 Apr 2020 05:55:42 GMT","server":"ESF","cache-control":"private","x-xss-protection":"0","x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","alt-svc":"quic=\":443\"; ma=2592000; v=\"46,43\",h3-Q050=\":443\"; ma=2592000,h3-Q049=\":443\"; ma=2592000,h3-Q048=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,h3-T050=\":443\"; ma=2592000","accept-ranges":"none","transfer-encoding":"chunked"}

Which I assume is correct and in the full log I don’t see any errors. In the end the function deployed successfully.

But when I go into Google Cloud console I don’t see the invoker permission or the allUsers member:

Should there be a permission there? I have other functions deployed and all of them show it, and they have been created weeks or even months ago:

jbohman on Apr 2, 2020

If you still have issue(s) with firebase denying your function invocations due to CORS errors, THIS IS HOW TO SOLVE THEM:

Error: Solution: Set region in your client where your function is hosted. For example: When importing function package: export const functions = getFunctions(app, "europe-central2") <--- region of your function; Then you can call your function: const doSomething= await httpsCallable(functions, 'doSomething');
Error: Solution: Set all users principal in google cloud console for this particular function. More here: https://github.com/firebase/firebase-functions/issues/645#issuecomment-605835353

juokavom on Nov 23, 2022

@alexstroukov Thanks! This definitely should be done automatically by firebase-cli, otherwise it can become a nightmare to deploy, waiting feedback from a Firebase team…