Auth blocking function beforeUserCreated doesn't return within 7 seconds

[tzappia]

Related issues

None

[REQUIRED] Version info

node: v22.6.0

firebase-functions: 5.0.1

firebase-tools: 13.15.2

firebase-admin: 12.3.1

[REQUIRED] Test case

Create blocking function:

export const beforeCreated = beforeUserCreated({
  region: 'us-west2',
}, async (event) => {
  const firestore = getFirestore();

  const newUser = {
    email: event.data.email,
    uid: event.data.uid,
  };

  const userDocRef = firestore.collection('users').doc();
  await userDocRef.create(newUser)
    .catch((error) => {
      return `Failed adding new user with email ${newUser.email}: '${error}'`;
    });

  return {
    customClaims: { fs_user_id: userDocRef.id },
  };
});

Create a new user in an app:

createUserWithEmailAndPassword(firebaseAuth, email, password);

[REQUIRED] Steps to reproduce

After deploying the blocking function, create a new user.

[REQUIRED] Expected behavior

Expect the user to be created.

[REQUIRED] Actual behavior

Auth user fails to create Error: Firebase: Cloud function deadline exceeded. (auth/internal-error).

According to the documentation, beforeUserCreated must return within 7 seconds, otherwise the error above will be encountered. My functions code doesn't have anything in global scope that would slow down cold starts. Functions and Firestore are in the same region. I suspect the fact that I am trying to write a Firestore document during beforeUserCreated may be slowing things down (perhaps the very first usage of Firestore is slow?) Subsequent requests are usually successful (once the cold start is complete.)

If there were a way to extend the 7 seconds that would avoid the error (better, but still not a great user experience because that is slow!) I could probably re-architect the solution to avoid the Firestore write inside beforeUserCreated if I were able to pass some custom properties either in the AuthBlockingEvent that beforeUserCreated receives or in what the function returns.

Note: the document that I'm writing to Firestore is actually written, so beforeUserCreated does complete successfully, just not within the required 7 seconds.

Were you able to successfully deploy your functions?

Yes

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[exaby73]

Hey @tzappia. Were you able to figure out whether the actual function takes that long or if there is a line of code in your function that hangs?

[tzappia]

@exaby73 it does not appear to be either my code or the function. As a workaround, I added in a fake call to createUserWithEmailAndPassword when a user arrives on my sign up page. It takes them a moment to fill out their details, then the real call to createUserWithEmailAndPassword is done and is successful. I see this as a cold start problem, my function is not able to start from cold and respond within the required 7 seconds.

FYI this is what my beforeUserCreated function does now to include my workaround:

  if (event.data?.email === '[email protected]') {
    throw new HttpsError('internal', 'coldstart');
  }

Then in my app I just silently discard the error.

[ahanusek]

I have two projects that use Google Cloud Functions (Firebase), and today I noticed enormous cold starts without any changes in the source code, which reach almost 15-30s 🤯. In one project, I'm using Cloud Run functions (1st gen), and in the second one, Cloud Run functions (2nd gen).

Cold start:

Then:

[exaby73]

This doesn't seem like an issue with the SDK. Might I suggest you contact Firebase support so that they can look at project

[tzappia]

@exaby73 I can contact support, however I also believe this to be SDK related as the 7 second requirement does not come from my project but is a requirement of the core library. It seems pretty common (based on others' comments) that a function may not start from cold within 7 seconds, independent of the project code.

[CorieW]

Hi @tzappia,

Did you ever figure this out?

[tzappia]

Nope

Hi @tzappia,

Did you ever figure this out?

[HassanBahati]

Hi @tzappia, I have attempted to reproduce this issue based on the details you provided.

Here are the results. For the functions reproduction i have attempted it here. And for the implementation of user creation i have attempted it here.

Function deployed successfully

User created successfully with createUserWithEmailAndPassword(firebaseAuth, email, password);

After deploying the blocking function, I created a new user successfully.

Below are the function logs;

The function executed at 20:57:41.630 and took about approximately 979ms.

Below is the document that was inserted into Cloud Firestore.

The document timestamp which was the time when the document insertion happened was approximately 17:57:41.761

NB: the 3 hour difference is due to timezone.

From the above, the function completed execution in approximately 979 milliseconds, which is well within the 7-second window...

Kindly confirm if you are working with a setup similar to the above reproduction example...

[tzappia]

Hi @HassanBahati , thanks for investigating this further. Yes, my setup is similar to what you have shown. There are a couple of important distinctions to be aware of though:

1. The timestamp on the document created in Firestore may not be relevant. The function may write that document but the timeout can still occur. The important point is whether the function returns within 7 seconds of whatever invokes it. If you didn't see an error then this is fine, but I wouldn't rely on the second timestamp as success/fail criteria.

2. The more important part is that you must wait until the function is cold before seeing the issue. If you ran this test soon after deploying it (or a 2nd time after running it) then the function will be warm. I only saw this issue when the function needed to be started from cold (which happens often enough because it may be days between creating account.) I don't know how you can force a function to do this, otherwise I'd say run the test again 24 hours after deploying it.

Thanks

[HassanBahati]

Hi @tzappia , thanks for your response and for providing more context that this issue is more likely to be seen a couple days after deploying the function.

I'll monitor the behavior over the next 2-4 days and will be sure to follow up with an update after running the test under cold start conditions

Appreciate your insights! I'll keep you posted

[cabljac]

Hi @tzappia

We've been unable to reproduce your issue so far. The best course of action is probably to raise a customer support ticket

That way a customer support dev/rep can provide specific assistance, with context of your specific GCP/firebase project.

[google-oss-bot]

Hey @tzappia. We need more information to resolve this issue but there hasn't been an update in 7 weekdays. I'm marking the issue as stale and if there are no new updates in the next 3 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

[google-oss-bot]

Since there haven't been any recent updates here, I am going to close this issue.

@tzappia if you're still experiencing this problem and want to continue the discussion just leave a comment here and we are happy to re-open this.