Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] Desktop Auth token refresh ignores UseEmulator() and targets production

Abierto
  • ¿Algo no está bien?
#1,934 1 comentario 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 3 días

@AustinBenoit ya está trabajando en esto.

Desde el 14/10/2026.

  • #1937 de @AustinBenoit — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
cpp, unity
Área
authentication

Línea de trabajo

Start in auth/src/desktop/rpcs/secure_token_request.cc, where the token URL is hard-coded as api_host, and compare it with how auth_request.cc's GetUrl() reads AuthImpl::assigned_emulator_url. Confirm the refresh request is the one hitting production before changing anything, since the reproducer has not been run. Done means GetToken(true) succeeds against the emulator on 127.0.0.1:9099.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

api: auth type: bug
[REQUIRED] Please fill in the following fields:
  • Pre-built SDK from the website or open-source from this repo: Pre-built native SDK bundled with Firebase Unity SDK 13.17.0.
  • Firebase C++ SDK version: 13.13.0.
  • Problematic Firebase Component: Auth.
  • Other Firebase Components in use: None.
  • Platform you are using the C++ SDK on: Mac, through the Unity Editor.
  • Platform you are targeting: iOS and Android; the failure occurs in the macOS Unity Editor.
[REQUIRED] Please describe the issue here:

Desktop Auth token refresh appears to ignore the endpoint configured through:

auth->UseEmulator("127.0.0.1", 9099);

Anonymous sign-in succeeds against the emulator. However, requesting an ID token for an existing authenticated user fails with “An internal error has occurred.” The user has a UID and is valid.

The failure was observed through the Unity wrapper. The standalone C++ reproducer below has not yet been compiled or run.

The desktop source shows a discrepancy:

  • Auth::UseEmulator() stores the configured endpoint in AuthImpl::assigned_emulator_url.
  • AuthRequest::GetUrl() uses that endpoint. Anonymous sign-in uses this method.
  • SecureTokenRequest, used for token refresh, bypasses GetUrl() and constructs a production URL directly:
const char api_host[] =
    "https://securetoken.googleapis.com/v1/token?key=";

This appears to send emulator-issued refresh tokens to production. The same hard-coded endpoint is present in the installed macOS native library, although the failing HTTP request has not been captured.

Expected behavior: all Auth requests, including token refresh, should use the configured emulator.

References:

Steps to reproduce:
  1. Start the Auth emulator on 127.0.0.1:9099.
  2. Create a Firebase app.
  3. Call UseEmulator() before performing authentication operations.
  4. Sign in anonymously.
  5. Call GetToken(false) to retrieve the fresh cached token.
  6. Call GetToken(true) to exercise the refresh path immediately.

The observed failure occurs when retrieving a token for an existing authenticated user. Explicitly forcing refresh is proposed here to reproduce the suspected failing path without waiting for token expiration.

Have you reproduced this with the Firebase C++ quickstarts? No.

Issue reproduction rate: Not measured.

Relevant Code:
#include <chrono>
#include <iostream>
#include <memory>
#include <thread>

#include "firebase/app.h"
#include "firebase/auth.h"

template <typename T>
bool WaitForResult(const char* operation,
                   const firebase::Future<T>& future) {
  while (future.status() == firebase::kFutureStatusPending) {
    std::this_thread::sleep_for(std::chrono::milliseconds(10));
  }

  if (future.status() != firebase::kFutureStatusComplete) {
    std::cerr << operation << ": invalid future\n";
    return false;
  }

  if (future.error() != 0) {
    std::cerr << operation << ": error " << future.error()
              << ": " << future.error_message() << '\n';
    return false;
  }

  std::cout << operation << ": succeeded\n";
  return true;
}

int main() {
  firebase::AppOptions options;
  options.set_project_id("demo-project");
  options.set_api_key("fake-api-key");
  options.set_app_id("1:1234567890:ios:0000000000000000000000");

  std::unique_ptr<firebase::App> app(
      firebase::App::Create(options, "auth-emulator-refresh-repro"));
  std::unique_ptr<firebase::auth::Auth> auth(
      firebase::auth::Auth::GetAuth(app.get()));

  auth->UseEmulator("127.0.0.1", 9099);

  // Reproduction only: clear cached auth state before creating a new user.
  // Read current_user() first to wait for persisted state initialization.
  auth->current_user();
  auth->SignOut();

  auto sign_in = auth->SignInAnonymously();
  if (!WaitForResult("Anonymous sign-in", sign_in)) {
    return 1;
  }

  auto user = auth->current_user();
  std::cout << "User UID: " << user.uid() << '\n';

  auto cached_token = user.GetToken(false);
  if (!WaitForResult("Cached token", cached_token)) {
    return 1;
  }

  // Exercise SecureTokenRequest immediately.
  auto refreshed_token = user.GetToken(true);
  return WaitForResult("Token refresh", refreshed_token) ? 0 : 1;
}
Lenguaje dominante
C++
Estrellas
326
Forks
137
Merge medio
2 d 5 h
PR fusionados (30 d)
8

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de firebase/firebase-cpp-sdk

Todos los issues de firebase/firebase-cpp-sdk

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.