Firebase Functions 7

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 746 lines · 1.5K tokens
  4. Firebase Functions 765 lines · 3K tokens
Total314 lines · 13K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 200
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 613
  • 639
  • 653
  • 674
  • 732
  • 754
  • 770
  • 799
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover HTTP, callable, database, messaging, storage, scheduled, and task queue functions written with firebase-functions 7 on the second-generation Node.js 24 runtime, and were checked against 7.3.2. Apply host-process controls from the Node.js baseline only where the managed platform exposes them.

Version and deployment configuration

  • Select Node.js 24 with engines.node: "24" in the functions package or runtime: "nodejs24" in firebase.json; the latter takes precedence. The SDK's >=18.0.0 engine range is not a hosted-runtime support policy. Keep first-generation functions in a separately configured codebase with a supported first-generation runtime; Node.js 24 is second-generation only.
  • Use explicit firebase-functions/v2/... imports for these handlers and keep legacy firebase-functions/v1 imports deliberate. Validate Express middleware and routing against the Express 5 dependency shipped by 7.3.2, and pin the Functions Framework used by the build so its parser behavior is reproducible.
  • Keep security-sensitive runtime options in setGlobalOptions() and per-function options, reviewing each override. Leave preserveExternalChanges false unless deployment also audits the effective external settings; source configuration otherwise overrides console changes.

Invocation identity and authorization

  • Require request.auth before protected work in onCall: the wrapper rejects invalid supplied Firebase ID tokens but permits requests without one. Authorize the verified