How can we share auth across subdomains?

[pankaj9296]

If a user logs in on mail domain example.com, how can I share the same auth on a subdomain like app.example.com or api.example.com?
Is it something possible with this package?
Or is there any workaround you can suggest?

[kmjennison]

As far as I know, Firebase doesn't support this. Open feature request: firebase/firebase-js-sdk#2303

There's probably a workaround with subdomain cookie settings and cross-domain messaging. Feel free to share any solutions here. However, we won't implement it in this package.

[JamesDonnelly]

I believe this question pre-dates the canary v1 package and Firebase v9 - so I'm not sure if something there has caused this to work - however I'm replying to this because I was having a similar issue that I spent a good couple of hours reading through various solutions to and this was one of the places I ended up.

I've got this working on my site by simply updating the initAuth script to include:

cookies: {
  domain: '.example.com',
  ...
},

I can now access the same AuthUser object on four different subdomains whilst the user only needs to log in one time.

I feel like this was far too easy and I'm almost certain I'm missing something painfully obvious about why this shouldn't be the solution, but unless someone says otherwise this is working just fine for me on subdomains I have deployed through Vercel.

[kmjennison]

Interesting, thanks for sharing! Is the user authenticated in the Firebase JS SDK on the different domains? I would have thought they wouldn't be and, consequently, though auth via SSR would work based on the cookie, the user would be considered unauthenticated once the Firebase JS SDK initializes.

[JamesDonnelly]

Ah that's a good point. My use case only involves initializing the Firebase JS SDK on the login/signup screen - beyond that everything else is done via my own API or getServerSideProps, so I think this works for my case but may not work for everyone.

My app isn't in front of many users just yet, so will keep an eye out to make sure everything works as I'm hoping it does.

[rightson1]

Hey, how can i access the initAuth script

[abdulrabbani00]

@JamesDonnelly - Any updates? Is the solution still good?