EC2实例部署Firebase Emulator遇网络请求故障求助

我已部署测试环境，想要将其连接到Firebase Emulator Suite实现认证服务，但使用端口4000的UI时，以下3个网络请求出现异常：

• http://172.31.40.139:9099/identitytoolkit.googleapis.com/v1/projects/play-on-dev/accounts:query
• http://172.31.40.139:9099/identitytoolkit.googleapis.com/v2/projects/play-on-dev/tenants
• http://172.31.40.139:9099/emulator/v1/projects/play-on-dev/config

但http://costagiannakopoulos.com/api/config请求可正常工作。

本地localhost运行Firebase时一切正常，为解决问题我在EC2实例上配置了NGINX作为反向代理，创建了域名costagiannakopoulos.com及子域名auth.costagiannakopoulos.com，相关配置如下，且/api/config返回的模拟器配置正常，已耗费数小时仍未解决，恳请提供建议。

firebase.json 配置 #

{
  "emulators": {
    "auth": {
      "host": "172.31.40.139",
      "port": 9099
    },
    "ui": {
      "enabled": true,
      "host": "172.31.40.139",
      "port": 4000
    },
    "hub": {
      "enabled": true,
      "host": "172.31.40.139",
      "port": 4400
    },
    "logging": {
      "enabled": true,
      "host": "172.31.40.139",
      "port": 4501
    },
    "singleProjectMode": true
  }
}

NGINX UI 配置 #

server {
    listen 80;
    server_name costagiannakopoulos.com;

    location / {
        proxy_pass http://172.31.40.139:4000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

NGINX 认证服务配置 #

server {
    listen 80;
    server_name auth.costagiannakopoulos.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name auth.costagiannakopoulos.com;
    ssl_certificate /etc/letsencrypt/live/auth.costagiannakopoulos.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/auth.costagiannakopoulos.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        proxy_pass http://172.31.40.139:9099;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

/api/config 返回内容 #

{
"auth": {
    "host": "172.31.40.139",
    "listen": [
        {
            "address": "172.31.40.139",
            "family": "IPv4",
            "port": 9099
        }
    ],
    "name": "auth",
    "port": 9099
},
"hub": {
    "host": "172.31.40.139",
    "listen": [
        {
            "address": "172.31.40.139",
            "family": "IPv4",
            "port": 4400
        }
    ],
    "name": "hub",
    "port": 4400
},
"logging": {
    "host": "172.31.40.139",
    "listen": [
        {
            "address": "172.31.40.139",
            "family": "IPv4",
            "port": 4501
        }
    ],
    "name": "logging",
    "port": 4501
},
"ui": {
    "host": "172.31.40.139",
    "listen": [
        {
            "address": "172.31.40.139",
            "family": "IPv4",
            "port": 4000
        }
    ],
    "name": "ui",
    "pid": 26141,
    "port": 4000
}
}

排查建议 #

1. 修正模拟器对外暴露地址：当前/api/config返回的auth地址是EC2内网IP172.31.40.139，外部客户端无法直接访问。修改firebase.json中auth模拟器的host为0.0.0.0（允许所有网卡监听），同时确保模拟器返回的配置中，auth的host是可外部访问的auth.costagiannakopoulos.com。
2. 添加UI反向代理的auth路径转发：Firebase UI会直接调用auth模拟器的接口，当前请求指向内网IP导致跨域或无法访问。在NGINX的UI配置中新增规则，将auth相关路径转发到auth模拟器：

location ~ ^/(identitytoolkit.googleapis.com|emulator) {
    proxy_pass http://172.31.40.139:9099;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
}

3. 配置CORS允许外部域名访问：Firebase模拟器默认CORS规则可能限制外部域名，启动auth模拟器时添加--cors参数指定允许的域名。比如创建cors-config.json：

{
  "origin": ["https://costagiannakopoulos.com", "https://auth.costagiannakopoulos.com"],
  "methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
  "allowedHeaders": ["Content-Type", "Authorization"]
}

然后执行：firebase emulators:start --only auth --cors ./cors-config.json
4. 统一协议避免混合内容问题：当前UI使用HTTP，auth使用HTTPS，会触发浏览器混合内容限制。修改NGINX UI配置，将HTTP请求重定向到HTTPS，并配置对应的SSL证书。
5. 检查EC2安全组规则：确保EC2实例的安全组允许NGINX所在进程访问9099端口（内部访问），如果需要直接访问auth模拟器则开放9099端口的外部访问权限。

内容的提问来源于stack exchange，提问作者Costa Giannakopoulos