Custom Claims: The hidden Firebase feature

Custom Claims is a Firebase Authentication feature that enables you to set access-control flags on your user JWTs. This requires a little explanation... but it's a critical part of building a secure Firebase app, so don't miss it!

Custom Claims docs:

Sample Cloud Function to manage Custom Claims:

[visugrame]

Watching your video at 2AM from Belgium 4month after publishing it and still having my mind blown. THANKS !

[evelynlima]

Denormalization is the duplication of same data at different locations in our database where they are needed in order to simplify or reduce querying.

[moradshebli]

Your content is amazingly refreshing and beneficial!

[mehmetasar]

Thank you very much Chris, I always watch you and support you.

[bdlla]

how to query users by custom claims in cloud functions ??

[charlestico]

Hi, I am creating a web app... I have a question, as soon as I create an user using Google/facebook and get the response back.
1. Call from the Client to the Backend to set the claims
2. Refresh the token so I can have a token with claims?


Are this steps correct?

[StiekemeHenk]

I'm integrating another platform, I think I want to store the userId (number) from the other platform in here to reduce api and database calls.
I have about 300 users right now, it increases by about 100 each year. Hope this fits the bill.

[Jovian_Nights]

I know this video is going back a long way, but if your product is an iOS app with no server, then where do you place the server side code?

[jonathanma]

So this feature can only be done a server application, like flask right? I'm trying to add custom claims to users, and right now I only have 2 react applications that are hooked up to firestore. Is it possible to build the feature of adding a custom claim without needing to build a flask or other server app?

[andrews]

Nice vid. I am setting custom claims in my app and there are use cases where the user token on the client needs to be refreshed as soon as their claim is set via a cloud function. This is important if the claims determine what they see in the UI of the app. Since most users aren't signing out and in and in and out all the time you need to call currentUser.getIdToken(true) on the client which refreshes the token.

[RoBuceo]

Hey Chris, thanks for your video!
Im a beginner and I have a question perhaps you could help me.
Im using the admin sdk with node.js.
Have you taken a look at the method called verifyIdToken?
It receives a token and it returns an object that allows you to get the email, uid and other attributes of the current user but not the customClaims
Do you know if there is a way to get the customClaims by a token?
Thanks

[ferrerasalexander]

Thanks. really is hidden feature jejeje.
Thanks for shared your code

[josephyoungquist]

Hi Chris, how are you setting node runtime to version 8 on your firebase functions?

[davyengone]

Hey Chris, nice finding there! Would you mind sharing the source code used in your example, please? Thanks a lot!

[akshaykumararasavalli]

nice video while opening the git repo it giving 404.Can You look at this issue