Firebase Auth多站点登录：跨域名实现一次登录持久化可行吗？

Hey there! Let's tackle this question head-on. First, to confirm what the official docs state: Firebase Auth's default web sessions are single-host origin bound, meaning they only persist under one domain, and you need explicit sign-outs to clear the state. But that doesn't mean cross-domain persistence is impossible—here are the most reliable approaches:

1. 使用自定义令牌（Custom Tokens）实现跨域登录同步 #

This method relies on your own backend to manage a shared user session across domains, then issue Firebase custom tokens to authenticate users on each domain:

• Step 1: Set up a backend service (e.g., Node.js, Python) that can verify a user's identity across domains. You could use a secure, HttpOnly, cross-domain cookie (configured with appropriate domain and SameSite attributes) to track the user's session across your domains.
• Step 2: When a user logs in on one domain, your backend generates a Firebase custom token using the Firebase Admin SDK (createCustomToken(uid)).
• Step 3: For other domains, when the user visits, your backend checks the cross-domain cookie to confirm the user's identity, generates a new custom token, and passes it to the frontend.
• Step 4: On each domain's frontend, call firebase.auth().signInWithCustomToken(customToken) to authenticate the user with Firebase. This will create a local Firebase session for that domain.

注意：跨域cookie需要严格配置SameSite=None（同时配合Secure属性，只在HTTPS下传输），并且确保你的域名都在同一主域下（比如app1.example.com和app2.example.com，主域是example.com），否则浏览器的同源策略会限制cookie共享。

2. 利用第三方OAuth身份提供商的跨域会话 #

If you're using OAuth providers like Google, Facebook, or GitHub with Firebase Auth, you can leverage their cross-domain sessions to avoid re-authenticating users across your domains:

• Step 1: Ensure all your domains are added to the OAuth provider's authorized domains list (e.g., in Google Cloud Console for Google Auth).
• Step 2: When a user logs in on one domain using the provider (e.g., signInWithPopup(provider)), the provider sets a cross-domain session cookie.
• Step 3: On another domain, initiate the same OAuth sign-in flow. Since the provider already has an active session, the user won't need to re-enter credentials—they'll be redirected back to your domain automatically.
• Step 4: Use the provider's credential (e.g., GoogleAuthProvider.credentialFromResult(result)) to sign in to Firebase Auth on that domain, creating a local session.

This works because most major OAuth providers use top-level domain cookies to track user sessions, which are accessible across subdomains (and sometimes even different domains if configured correctly).

3. 基于Firebase Auth会话的跨域传递（需后端中转） #

Another approach is to securely transfer the Firebase Auth session ID from one domain to another via your backend:

• Step 1: On the source domain, retrieve the user's Firebase Auth ID token using firebase.auth().currentUser.getIdToken().
• Step 2: Send this ID token to your backend over a secure HTTPS request.
• Step 3: Your backend verifies the ID token using the Firebase Admin SDK (verifyIdToken(idToken)), confirms the user's identity, and generates a short-lived, one-time use token (or uses the existing custom token method).
• Step 4: Redirect the user to the target domain, passing the one-time token as a URL parameter (ensure this is done over HTTPS to prevent interception).
• Step 5: On the target domain, retrieve the token from the URL, send it to your backend to validate, then get a custom token and sign in to Firebase Auth.

警告：直接传递 Firebase ID tokens via URL parameters is not recommended long-term, as they can be logged in server logs or browser history. Always use short-lived, one-time tokens as an intermediary.

Key Notes #

• All these methods require your domains to be using HTTPS, as modern browsers restrict cross-domain cookie sharing and secure token transmission to encrypted connections.
• You'll need to handle edge cases like session expiration—make sure your backend checks if the user's session is still valid before issuing tokens.
• Firebase Auth's built-in session management won't handle cross-domain sync automatically, so you'll need to implement custom logic to keep sessions in sync (e.g., listening for auth state changes on one domain and updating the backend to invalidate tokens on others when the user signs out).

内容的提问来源于stack exchange，提问作者user8146328