Repository navigation
🚀 [auth] Allow passing in raw nonce when using signInWithCredential #8346
Description
When using signInWithCredential, there doesn't appear to be a way to pass in the raw nonce, which is required if you're using an id token that contains a nonce: https://firebase.google.com/docs/reference/kotlin/com/google/firebase/auth/OAuthProvider.CredentialBuilder#setIdTokenWithRawNonce(java.lang.String,java.lang.String)
Maybe it could just be added to the AuthCredential interface and then passed down into the native signInWithCredential along with the provider ID, token and secret
Activity
mikehardy commentedon Feb 18, 2025
Hey @henribru - how do they do it in firebase-js-sdk ? Our "job" - in the sense of discriminating between things we can do here and things we cannot - is to implement the firebase-js-sdk APIs, either directly binding them to identical APIs in firebase-ios-sdk / firebase-android-sdk or doing internal things to "bend" what an firebase-js-sdk-compatible API implementation gives us into whatever shape the native firebase-android-sdk / firebase-ios-sdk make available to us, so that we end up with similar results
So always best to start with the firebase-js-sdk guides and reference docs to see how they would to it as that will have to be our API, then check the native ios/android docs make available to see if it is feasible in the native context
henribru commentedon Feb 18, 2025
They do it basically how I'm suggesting, I believe. When creating a credential
rawNonceis one of the options you can pass in:https://firebase.google.com/docs/reference/js/auth.oauthprovider.md#oauthprovidercredential
https://firebase.google.com/docs/reference/js/auth.oauthcredentialoptions.md#oauthcredentialoptions_interface
github-actions commentedon Mar 18, 2025
feat(auth): add raw nonce support to signInWithCredential (invertase#…
2020gaurav commentedon Dec 18, 2025
Just following up on this issue, is there any plans to pick this us ? This is blocking us from using nonce verification. We can't disable it as that can lead to potential replay attacks.