Using verifyIdToken()` with the second argument causes serverless function to timeout

• Operating System version: Ubuntu Xenial 16.04
• Firebase SDK version: 8.13.0
• Firebase Product: auth
• Node.js version: v12.18.0
• NPM version: 6.14.4

Steps to reproduce:

Using verifyIdToken(idToken, true) with the second argument to check if the token has been revoked causes Netlify serverless Function to timeout.

Relevant Code:

Publish the following code below to a Netlify function, then hit the endpoint which includes a valid JWT with an “Authorization” header and the lambda function will consistently timeout.

However if you remove the second argument from verifyIdToken() and republish the function again, there are no issue at all.

const admin = require("firebase-admin")

const SERVICE_ACCOUNT = JSON.parse(process.env.FIREBASE_CONFIG);

if (!admin.apps.length) {
  admin.initializeApp({
    credential: admin.credential.cert(SERVICE_ACCOUNT)
  });
}

exports.handler = async function (event, context, callback) {

  try {
    // Extract JWT from header
    const JWT = event.headers.authorization;

    // Verify JWT, if user deleted, or JWT is invalid, this will throw an error
    const user = await admin.auth().verifyIdToken(JWT, true);

    callback(null, {
      statusCode: 200,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(user)
    });
  } catch (error) {
    console.error("There was an error", error);
    callback(null, {
      statusCode: 400,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ error })
    });
  }
};

[hiranya911]

Ok, that forum post actually helped.

This is often resolved by changing the function code to include calls to close “the connection”. As far as what “the connection” actually is, it is typically a connection to an API or database.

You need to clean up the App instance (app.delete()) to ensure proper clean up of the Admin SDK: https://firebase.google.com/docs/reference/admin/node/admin.app.App#delete

This is not required in most environments. But it appears it’s required in Netlify.

[alexanvl]

We started to see this error at 2022-09-23 09:49:08.055 PDT in the firebase-admin@11.0.1 package, running in a node:16 container within GKE. Setting the checkedRevoked parameter to false seems to resolve the issue and we’re try to determine what caused it.