Firebase短动态链接集成用户ID与JWT实现自动登录及Analytics问询

Great question—let’s break these down with practical, secure best practices tailored to your use case:

1. Should user ID be a Firebase API parameter or query string? #

Put it in the query string of your target link, not as a top-level Firebase API parameter.

Firebase’s core API parameters (like androidInfo, iosInfo) exist to control link behavior—think platform routing, app opening rules, and basic link metadata. User IDs are business-specific data that needs to reach your app/service when the link is clicked. Embedding it directly in the link field’s query params ensures your app can extract it immediately after the link redirects, with no extra parsing of Firebase-specific fields.

2. Which parameters/custom parameters should you use? #

Here’s a curated list to cover your auto-login and analytics needs:

• Custom user ID param: Add a clear query param like user_id=USER_UNIQUE_ID to your target link (e.g., https://www.example.com?user_id=123abc). This lets your app instantly identify which user the link is tied to.
• Firebase UTM parameters: Use built-in UTM params (utm_source, utm_medium, utm_campaign) in your link to track link attribution. For example: https://www.example.com?user_id=123abc&utm_source=email&utm_campaign=post_signup—Firebase Analytics will automatically capture these and show you which channels drive the most clicks and login attempts.
• Optional custom context params: If you need extra context (like why the link was sent), use Firebase’s customParameters field in the dynamicLinkInfo object. These will be appended to your target link automatically. Example modified request:

  {
    "dynamicLinkInfo": {
      "dynamicLinkDomain": "example.app.goo.gl",
      "link": "https://www.example.com?user_id=123abc&utm_source=email",
      "androidInfo": { "androidPackageName": "com.example.mobile.android" },
      "iosInfo": { "iosBundleId": "com.example.app.ios" },
      "customParameters": {
        "link_purpose": "auto_login"
      }
    }
  }
  

• Login outcome tracking: After your app processes the auto-login, send custom Firebase Analytics events like login_success or login_failed, passing the user_id and link_purpose as event parameters. This lets you tie login results directly back to specific links and channels.

3. Is putting JWT in the dynamic link’s query string a best practice? #

Absolutely not—this is a critical security risk. Query strings are logged in browser histories, server logs, and Firebase’s link click records, exposing sensitive JWT data (which often contains user claims, expiration dates, or encrypted credentials) to potential attackers.

Instead, use this safer flow:

1. Only pass the user_id in the dynamic link.
2. When your app opens the link, extract the user_id and send a secure, authenticated request to your backend.
3. Your backend validates the user’s identity (e.g., checks if the link was generated for this specific user) and returns a short-lived JWT or temporary login token.
4. Use that token to authenticate the user in your app.

This way, sensitive credentials never touch the dynamic link itself, reducing exposure risk significantly.

内容的提问来源于stack exchange，提问作者wizard