Using Firebase Auth Custom Claims Correctly

Question

This is intended to be a generic question, but I do have a specific problem! Thanks in advance...

I'm using Custom Claims with Firebase Auth. Specifically I'm using Angular/fire. Generically, I'm trying to set a custom claim to identify a user role and the listings that a user owns in my DB.

First, I used:

const uid = 000111222333
admin.auth().setCustomUserClaims(uid, {
    business: true
});

Worked perfectly. When inspecting the token on authorisation I see the claim.

Second, I tried setting a role (hoping to set this in addition to the listing ID):

const uid = 000111222333 // same user
const listing id = 'abc123xyz'
admin.auth().setCustomUserClaims(uid, {
    [listing.id]: true
});

Here's the problem. Now, when I inspect the auth token, I see the listing ID claim but the business role claim is gone.

Why is that?

Should I only have one property and use an array to store both claims as strings? What's the best practice if I need to set a number of claims such as role, and perhaps 20 listing IDs that the user owns. I'm looking to use this method as it makes the httpsCallable functions and storage security easier to manage.

Does this answer your question? Firebase Admin SDK: Set / Merge Custom User Claims — Christopher Peisert

Renaud Tarnec Renaud Tarnec · Accepted Answer · 2019-09-19T18:35:24

As explained in the doc, when you call admin.auth().setCustomUserClaims() it "always overwrites the user's existing custom claims".

So it means that each time you want to add a Custom Claim, you need to first read the existing ones and set them again with the new one.

Using Firebase Auth Custom Claims Correctly

1 Answers