FirebaseFunctions 12.17 sends physical-device emulator calls without auth

[YashTotale]

Description

After updating to Firebase iOS SDK 12.17.0, callable requests from a physical iPhone to the local Functions emulator arrive without authentication.

The app is connected to the Auth and Functions emulators using my Mac's LAN address. Google sign-in succeeds, currentUser is set, and the user appears in the Auth emulator. The next callable request still reaches the Functions emulator, but request.auth is undefined.

In my app, this was especially confusing because the backend treated the request as a guest onboarding request and returned an anonymous custom token. The client then replaced the correctly signed-in Google user with that anonymous user.

I found #16395, so I understand that withholding credentials over non-loopback HTTP is intentional. I am not asking for the old behavior to be restored by default.

The problem is that I cannot find a supported replacement for testing authenticated callables on a physical device. The phone cannot use the Mac's loopback address, and the Firebase CLI serves the Functions emulator over HTTP. The SDK also continues making the request without credentials, which can change application behavior rather than producing a clear connection or security error.

Could the physical-device workflow be documented? If HTTPS is the intended solution, it would be helpful to show how useEmulator should be configured when the Firebase CLI itself serves HTTP. It may also be safer to fail the request when credentials are withheld instead of silently sending it unauthenticated.

Environment:

• Physical iPhone 13 running iOS 26.6
• Xcode 26.4.1
• Firebase iOS SDK 12.17.0
• CocoaPods
• Firebase CLI 15.18.0
• React Native Firebase 26.2.0

Reproducing the issue

1. Start the Authentication and Functions emulators and expose them on the local network.
2. On a physical iPhone, configure both emulators using the Mac's LAN IP address.
3. Sign in with Google through the Authentication emulator.
4. Confirm that Auth.auth().currentUser is set.
5. Call an HTTPS callable function that logs request.auth?.uid.
6. The function runs, but the UID is missing.

The same app then reports auth/required for authenticated callable actions.

Firebase SDK Version

12.17.0

Xcode Version

26.4.1

Installation Method

CocoaPods

Firebase Product(s)

• Authentication
• Functions

Targeted Platforms

• iOS

Relevant Podfile.lock entries

- Firebase/Auth (12.17.0)
- Firebase/Functions (12.17.0)
- FirebaseFunctions (12.17.0)
- RNFBApp (26.2.0)
- RNFBAuth (26.2.0)
- RNFBFunctions (26.2.0)

[paulb777]

Sorry about the behavior change and thanks for the detailed issue report.

Let us know if you have any feedback about the proposed fix at #16541

[YashTotale]

Thanks for taking a look, and for the quick turnaround.

The explicit error is definitely better than silently dropping the tokens, since that's what made this so confusing to track down. But I want to make sure I'm not missing something, because with the fix in place I think my device build goes from "silently signed out" to "every authenticated call fails." Either way I can't run the app on a physical iPhone against my local emulator, which is what I was doing before 12.17. The simulator isn't a substitute for me, so as it stands I don't have a way to test these flows at all.

So my real question is about workflow. What's the recommended way to develop against the Functions emulator on a real device now? Two things I've considered:

1. Put an HTTPS proxy in front of the emulator with a self-signed cert and trust it on the device. Is that the intended path? If so, is there a setup you'd recommend, since the CLI serves plain HTTP?
2. Some kind of opt-in flag so I can say "yes, I know this is my LAN, send the tokens anyway," ideally only available in debug builds.

If neither is right, I'd love to know what is. Right now I've pinned React Native Firebase to the last version before 12.17 to keep working, but I'd rather move to a supported setup.

[paulb777]

@YashTotale I'll follow up with the team on this next week. In the meantime, here's Gemini's suggestion:

Thanks for the detailed follow-up. You highlight a very valid pain point for physical device testing. The reason we restricted LAN IPs is that if a developer connects to a local Functions emulator on a LAN without also using the Auth emulator, their real production Auth tokens would be broadcasted in plaintext over the local network (e.g., on a public coffee shop Wi-Fi).

To answer your question about workflow: the recommended and least-friction path is to put an HTTPS proxy in front of the emulator. However, you don't necessarily need to deal with the pain of self-signed certs and manually trusting them on your iPhone.

Recommended Setup (Using a Tunnel)

The easiest supported workflow is to use a tunneling service like ngrok or localtunnel, which gives you a fully trusted public https:// URL that routes directly to your local machine.

1. Run the proxy against your Functions emulator port:

   ngrok http 5001

2. In your app, configure the secure tunnel URL via customDomain instead of useEmulator:

   let functions = Functions.functions()
   functions.customDomain = "https://<your-id>.ngrok-free.app"

This completely satisfies the SDK's transport security requirements, encrypts the tokens in transit, and routes seamlessly to your local emulator CLI.

[YashTotale]

Thanks Paul, appreciate you bringing it to the team.

One thing worth considering in that discussion: I'm running the Auth emulator too, so the tokens are emulator-issued and there's nothing real to leak on the network.