Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] Desktop Auth token refresh ignores UseEmulator() and targets production

Aperta
  • Qualcosa non va?
#1,934 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

@AustinBenoit ci sta già lavorando.

Dal 14/10/2026.

  • #1937 di @AustinBenoit — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
cpp, unity
Ambito
authentication

Direzione di ricerca

Start in auth/src/desktop/rpcs/secure_token_request.cc, where the token URL is hard-coded as api_host, and compare it with how auth_request.cc's GetUrl() reads AuthImpl::assigned_emulator_url. Confirm the refresh request is the one hitting production before changing anything, since the reproducer has not been run. Done means GetToken(true) succeeds against the emulator on 127.0.0.1:9099.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

api: auth type: bug
[REQUIRED] Please fill in the following fields:
  • Pre-built SDK from the website or open-source from this repo: Pre-built native SDK bundled with Firebase Unity SDK 13.17.0.
  • Firebase C++ SDK version: 13.13.0.
  • Problematic Firebase Component: Auth.
  • Other Firebase Components in use: None.
  • Platform you are using the C++ SDK on: Mac, through the Unity Editor.
  • Platform you are targeting: iOS and Android; the failure occurs in the macOS Unity Editor.
[REQUIRED] Please describe the issue here:

Desktop Auth token refresh appears to ignore the endpoint configured through:

auth->UseEmulator("127.0.0.1", 9099);

Anonymous sign-in succeeds against the emulator. However, requesting an ID token for an existing authenticated user fails with “An internal error has occurred.” The user has a UID and is valid.

The failure was observed through the Unity wrapper. The standalone C++ reproducer below has not yet been compiled or run.

The desktop source shows a discrepancy:

  • Auth::UseEmulator() stores the configured endpoint in AuthImpl::assigned_emulator_url.
  • AuthRequest::GetUrl() uses that endpoint. Anonymous sign-in uses this method.
  • SecureTokenRequest, used for token refresh, bypasses GetUrl() and constructs a production URL directly:
const char api_host[] =
    "https://securetoken.googleapis.com/v1/token?key=";

This appears to send emulator-issued refresh tokens to production. The same hard-coded endpoint is present in the installed macOS native library, although the failing HTTP request has not been captured.

Expected behavior: all Auth requests, including token refresh, should use the configured emulator.

References:

Steps to reproduce:
  1. Start the Auth emulator on 127.0.0.1:9099.
  2. Create a Firebase app.
  3. Call UseEmulator() before performing authentication operations.
  4. Sign in anonymously.
  5. Call GetToken(false) to retrieve the fresh cached token.
  6. Call GetToken(true) to exercise the refresh path immediately.

The observed failure occurs when retrieving a token for an existing authenticated user. Explicitly forcing refresh is proposed here to reproduce the suspected failing path without waiting for token expiration.

Have you reproduced this with the Firebase C++ quickstarts? No.

Issue reproduction rate: Not measured.

Relevant Code:
#include <chrono>
#include <iostream>
#include <memory>
#include <thread>

#include "firebase/app.h"
#include "firebase/auth.h"

template <typename T>
bool WaitForResult(const char* operation,
                   const firebase::Future<T>& future) {
  while (future.status() == firebase::kFutureStatusPending) {
    std::this_thread::sleep_for(std::chrono::milliseconds(10));
  }

  if (future.status() != firebase::kFutureStatusComplete) {
    std::cerr << operation << ": invalid future\n";
    return false;
  }

  if (future.error() != 0) {
    std::cerr << operation << ": error " << future.error()
              << ": " << future.error_message() << '\n';
    return false;
  }

  std::cout << operation << ": succeeded\n";
  return true;
}

int main() {
  firebase::AppOptions options;
  options.set_project_id("demo-project");
  options.set_api_key("fake-api-key");
  options.set_app_id("1:1234567890:ios:0000000000000000000000");

  std::unique_ptr<firebase::App> app(
      firebase::App::Create(options, "auth-emulator-refresh-repro"));
  std::unique_ptr<firebase::auth::Auth> auth(
      firebase::auth::Auth::GetAuth(app.get()));

  auth->UseEmulator("127.0.0.1", 9099);

  // Reproduction only: clear cached auth state before creating a new user.
  // Read current_user() first to wait for persisted state initialization.
  auth->current_user();
  auth->SignOut();

  auto sign_in = auth->SignInAnonymously();
  if (!WaitForResult("Anonymous sign-in", sign_in)) {
    return 1;
  }

  auto user = auth->current_user();
  std::cout << "User UID: " << user.uid() << '\n';

  auto cached_token = user.GetToken(false);
  if (!WaitForResult("Cached token", cached_token)) {
    return 1;
  }

  // Exercise SecureTokenRequest immediately.
  auto refreshed_token = user.GetToken(true);
  return WaitForResult("Token refresh", refreshed_token) ? 0 : 1;
}
Lingua principale
C++
Stelle
326
Fork
137
Merge medio
2g 5h
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di firebase/firebase-cpp-sdk

Tutte le issue di firebase/firebase-cpp-sdk

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.