April 2018 Summaries

Firebase Authentication introduced several updates aimed at simplifying secure user registration, sign-in, and session management. Most projects have been migrated to a higher-performance Google-powered email service, while remaining customers must complete a manual verification step, and developers can alternatively configure custom SMTP servers. New passwordless email-link authentication is available on Android, iOS, and web, allowing users to sign in through an emailed link instead of a password. Developers can now access custom ID-token claims directly in client applications to tailor features and interfaces based on user roles or permissions, although claims are limited to access-control data, a total size of 1,000 bytes, and should be accompanied by ID tokens when sent to backend services. Firebase also added server-side session controls through JWT-based session cookies issued with the Admin SDK, enabling configurable session durations from five minutes to two weeks.

Firebase Cloud Messaging, introduced in 2016 as the successor to Google Cloud Messaging, provides free, reliable notification and data messaging for iOS, Android, and web applications, while adding Firebase console controls, reporting, platform overrides, topic combinations, and integrations with A/B Testing and Predictions. Google announced that GCM server and client APIs were deprecated and could be removed as early as April 11, 2019, requiring developers to migrate their projects to FCM. Migration involves creating a Firebase project using the existing Cloud Project ID, updating app code as needed, and changing the server endpoint, although these steps can be completed independently over time. Existing GCM tokens remain usable with FCM, and its backward compatibility allows users of unupdated apps to continue receiving messages. Developers are directed to migration guides, FAQs, video resources, Stack Overflow, and Firebase support, while privacy concerns are addressed through Firebase’s policies and an option to disable Google Analytics for Firebase, which may limit some FCM capabilities.

Firebase introduced Version History for Cloud Firestore Security Rules in the Firebase console, allowing teams to review every previously published rules version, compare older versions with the latest changes, and restore or selectively reuse earlier rules. The feature helps teams identify and reverse problematic security-rule updates made through the browser or deployments. Users can access version history from Cloud Firestore’s Rules tab, where each deployment containing rules is recorded as a new version, including deployments that do not alter the rules. To reduce unnecessary duplicate versions, developers can use the Firebase CLI’s `deploy --only` option to deploy only changed components, such as Cloud Functions. Firebase also invited feedback and indicated plans to extend version-history capabilities to other Firebase features.

Firebase released version 1.0 of its Cloud Functions SDK, enabling developers to build serverless backend logic in JavaScript or TypeScript that runs on Google Cloud infrastructure in response to app events. The service integrates with Firebase products such as Authentication, Cloud Firestore, Cloud Messaging, and Cloud Storage, supports automatic scaling and pay-per-use pricing, and can also handle external integrations such as Stripe webhooks, as illustrated by Posse’s Hamilton ticket lottery app. The release introduces Callable HTTPS functions and client SDK support for iOS, Android, and web, simplifying secure calls from apps by automatically handling HTTPS connections, data serialization, and Firebase authentication or messaging tokens. It also adds the firebase-functions-test module for offline or development-project unit tests, formally supports local function emulation through updated Firebase CLI commands, and provides health, error, performance, latency, and memory monitoring. Developers upgrading from the beta SDK must update their code to match revised APIs, although existing deployed functions remain unaffected, while the underlying Cloud Functions platform continues to be in beta.