Sign in with any OpenID provider, instead of Firebase

[monperrus]

Firebase Authentication is the one part of a self-hosted app/ that still needs an account with somebody. It turns out to be a thin dependency, and taking it out makes the app work against Keycloak, Authelia, Zitadel, Dex, Auth0 or Google without a line of code changing.

The server barely moves

It never used the Firebase admin SDK: it verified ID tokens as ordinary RS256 JWTs against Google's published keys, with the issuer and audience spelled the Firebase way. So the verifier now takes issuer, audience and key set as configuration, and discovers the key set from the issuer's /.well-known/openid-configuration when it is not given one.

Discovery is deferred to the first token rather than done at boot: the app and the provider start together in a compose stack, and one refusing to start because the other was still starting is a worse failure than a first request that waits. A failed discovery is not cached, so a provider that was briefly down does not need a restart.

FIREBASE_PROJECT_ID still works, as shorthand for the issuer, audience and key set it always stood for — an existing deployment keeps verifying the tokens it already issued while it migrates.

Variable	Purpose
VITE_OIDC_ISSUER, VITE_OIDC_CLIENT_ID	compiled into the client
OIDC_ISSUER, OIDC_AUDIENCE	what the API checks; both default to the VITE_ values
OIDC_JWKS_URI	optional, discovered from the issuer otherwise
FIREBASE_PROJECT_ID	legacy shorthand, still accepted

The browser is the half that changed

firebase/auth is replaced by oidc-client-ts doing authorization code with PKCE (-1083 lines of lockfile). The session is mapped onto the same handful of fields the app already read from a Firebase user — uid, email, display name, verified, a token getter — so the account, consent, vault and invitation screens did not have to care.

What did have to change: this app no longer holds passwords. Setting one, resetting one, registering, verifying an address all belong to whoever stores the password. So the sign-up and reset screens are gone, /signup and /reset redirect to /login, and sign-in is one button that hands over to the provider — which shows a Register link exactly when it accepts registrations, a truer answer than anything this app could infer from its own configuration.

The one visible loss is the terms/privacy checkbox that sign-up carried. Worth a decision before merging: it can come back as a one-time consent screen after the first sign-in, in a follow-up, if you want the record kept.

Account deletion

It asks the provider for a fresh sign-in, in a popup with prompt=login, because the screen that asks has typed confirmation in it and a redirect would throw that away. The service is then emptied exactly as before, and the server's ten-minute auth_time check still applies.

The identity itself is not deleted from here: a public PKCE client has no standing to remove a user, and OpenID Connect gives it no way to ask. It is removed where it lives, which is also where it can be removed from every other application using it. The screen says so.

Headers

The document policy is built from the configured issuer instead of a list of Google hostnames, and frame-ancestors relaxes from 'none' to 'self': silent renewal loads this app's own callback in a hidden iframe, and 'none' would have ended every session at its token's expiry. X-Frame-Options on documents becomes SAMEORIGIN for the same reason. The API's own responses are untouched and still send DENY.

Deployment

app/docker-compose.yml, .env.example, wrangler.jsonc and both workflows take the new variables. render-deploy-config.mjs now requires OIDC_ISSUER + OIDC_AUDIENCE or FIREBASE_PROJECT_ID, and fails naming what is missing rather than rendering a Worker that refuses every call.

Deploying this needs two new repository variables, VITE_OIDC_ISSUER and VITE_OIDC_CLIENT_ID, and a public PKCE-S256 client at the provider whose redirect URI is <WEB_ORIGIN>/auth/callback and whose web origins list <WEB_ORIGIN> — the second is what lets renewal work.

Checks

npm run typecheck, npm test (887 passing), npm run lint and npm run build all pass in app/, plus node scripts/test-landing-seo.mjs at the root. New tests cover the verifier (issuer, audience, discovery, email_verified, auth_time), the configuration reader including the Firebase fallback, and the policy builder.

Running against Keycloak 26 at https://auth.gakoy.com since 2026-09-11.

🤖 Generated with Claude Code