Field notes from production Firebase work.
September 21, 2026 · FlameRangers
ID tokens expire every hour and never reach your server on a hard navigation. Session cookies do. Here is the exchange endpoint, the verification path, the revocation story, and what each choice costs per request.
Read moreSeptember 21, 2026 · FlameRangers
Storage gets the rules nobody tests. Client-declared content types, unbounded uploads, and Firebase download tokens that ignore your ruleset entirely — plus the egress line they put on your invoice.
Read moreSeptember 21, 2026 · FlameRangers
Background triggers are at-least-once. A duplicate delivery double-charges a card, a thrown error with retries enabled loops for seven days, and both show up on the invoice before they show up in your dashboards.
Read moreSeptember 18, 2026 · FlameRangers
Firestore reads scale almost without thinking about it. Writes do not. Three limits — one write per second per document, 500 writes per second per index range, and transaction retry budgets — cause most of the ABORTED and DEADLINE_EXCEEDED errors we get called about.
Read moreSeptember 17, 2026 · FlameRangers
Firebase AI Logic lets a mobile or web client call Gemini without an API key in the bundle. It does not stop one user from spending your monthly model budget in an afternoon. Here is the enforcement stack we install.
Read more