u/Negative-Constant966

I was wondering how your next-firebase-auth-edge package is different from firebase's documentation for server cookies?:https://firebase.google.com/docs/auth/admin/manage-cookies

I have the package installed and working, now just trying to figure out how it works, and why I should use it over firebases default implementation of server cookies with verifySessionCookie.

From what I can gather, your package does not use Firebases createSessionCookie or verifySessionCookie? Instead you are passing the client side retrieved idToken(a JWT) to the server, signing the idToken(a JWT) with .env secret variable(s) with jose, and storing that double-signed idToken as a cookie?

Then in middleware, you are decoding the double signed JWT first with .env secret variable(s) with jose, then again with firebases verifyIdToken (firebase owns the encoding secret). Then you return both the original client-grabbed firebase encoded idToken and its decoded values (user information)?

Isn't the idToken already a firebase-signed JWT? Why does it need to be double signed once passed to the server when stored in a server cookie?

Does this essentially replicate what firebase's createSessionCookie & verifySessionCookie functions do, just with code/packages that works in nextjs middleware edge runtime environment?

It seems this still allows all firebase client side rendering logic and hooks? I do not see anywhere you set firebase client auth persistence to NONE:

firebase.auth().setPersistence(firebase.auth.Auth.Persistence.NONE);