[Functions, Storage] Emulator authentication fix

[paulb777]

Enforce explicit errors for insecure HTTP token withholding and refactor authorization logic

Description

This pull request improves the developer experience and safety of the transport layer security rules introduced for Firebase Functions and Firebase Storage. It addresses an issue where silently stripping credentials over non-loopback HTTP connections could result in confusing application behavior (such as unexpected guest onboarding) by instead failing fast with an explicit error.

Key Changes

• Fail Fast on Insecure Connections: When a request is directed to a non-loopback HTTP endpoint and authentication tokens are present, the SDKs now explicitly fail the request with an unauthenticated error (instead of silently sending an unauthenticated request). Unauthenticated requests (where no tokens are present) remain unaffected and will still proceed normally.
• Refactored Token Authorization: Flattened the token attachment logic in both Functions.swift and StorageTokenAuthorizer.swift by using early-return guard statements, significantly improving code readability.
• Optimized Scheme Evaluation: Extracted the URL scheme evaluation in StorageTokenAuthorizer.swift into a local variable to prevent redundant .lowercased() string operations.

Testing

• Updated testCallFunctionOverHttpWithoutLocalhostFailsWhenTokensPresent and testInsecureHostFailsWhenTokensPresent to verify that requests are explicitly blocked with unauthenticated errors when tokens are withheld.
• Added testCallFunctionOverHttpWithoutLocalhostSucceedsWhenNoTokensPresent and testInsecureHostSucceedsWhenNoTokensPresent to ensure that standard, unauthenticated HTTP requests continue to work as expected.
• Initialized mock GTMSessionFetcher instances with allowedInsecureSchemes = ["http"] during unit tests to accurately simulate the emulator networking conditions.

Related Issues

• Resolves #16536

[gemini-code-assist]

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

[paulb777]

See the discussion at #16536. I'm not sure about this.

For apps testing other Firebase products, it might be better to let Auth silently succeed than to throw an exception.

[paulb777]

@ncooke3 See the new allowInsecureTokenAttachment property