[firebase_auth] token issued by createCustomToken are not valid with emulated in <<demo>> project

[cedvdb]

As per the documentation:

<< For security reasons, the Authentication emulator issues unsigned ID tokens, which are only accepted by other Firebase emulators, or the Firebase Admin SDK when configured. >>

So when there is an env variable FIREBASE_AUTH_EMULATOR_HOST="127.0.0.1:9099" firebase admin is supposed to give unsigned tokens via the emulator, which it does not:

The following:

    const user = await admin.auth().createUser({ uid: randomUUID() });
    const jwt = await admin.auth().createCustomToken(user.uid);

Results in:

Firebase ID token has incorrect "aud" (audience) claim. Expected "demo-test" but got "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit" 

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[shelbycotton]

Were you able to resolve? I'm experiencing the same issue.

[karthikrao5]

Dealing with the same problem. The verifyIdToken function expects the project id in the aud except the token created by the same instance of the auth emulator uses https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit

[cedvdb]

@shelbycotton

I did not resolve this issue and had to work around it

[luisjoserivera]

I get this error only if i try to verify the token generated by createCustomToken. If you pass the token to signInWithCustomToken in the client app then get the user token with auth.currentUser.getIdToken your will notice the token is slightly different and claims are the expected ones. You can then verify this token in your backend and no errors show up.

[mp3por]

I am facing the same issue.

At the moment I am doing what @luisjoserivera said but on the backend. I initialise a client instance of FB with the same credentials and then simulate a login, getId, logout to get the ID token.

[wieringen]

I'm having the same problem. createCustomToken doesn't respect the emulator.