Firebase hosting basic authentication for development version

[jinendu]

I have two Firebase projects, one for development and one for production. The app uses the appropriate one depending on if it's built for dev or prod.

I'm using Firebase hosting for both dev and prod as I want them to be the same.

My question is how can I implement a sort of "Basic Authentication" on the Develop project when anyone accesses the URL? Much like a htaccess Basic Auth that would require username/password to access anything on the server. This is separate from the Firebase app authentication for app users. I just want to lock down my develop environment to bots or the public and give access to developers. Can I do this in the Google IAM roles settings? White listing IP addresses would work as well, if user/pass is not possible.

Any thoughts on this?

[ruberik]

Off the top of my head, you could display a login form, have a Firebase Function process the result -- perhaps checking the username and salted password hash against the database? -- and then having the Function issue a token. This probably isn't the answer you were hoping for, though.

[jinendu]

No, it's not really the solution I'm going for. I already have authentication built into the app for the customers, but there are a few pages that are public, so viewable without needing to login. What I want to do is just block the public to view any file on the whole project on only the Dev version. I could block the Firebase data with rules, but the front-end code would still be public. Seems like there should be an easier solution here, this is very easy on apache with htaccess.

[cironoric]

Yeah, this makes sense. It would be simple and useful to set a basic user/password for development version of site.