Redirect and rewrite rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Firebase Hosting Redirect Behavior

Given the following Firebase Hosting redirect rule, what will happen when a user visits /old-page?

{
  "hosting": {
    "redirects": [
      {
        "source": "/old-page",
        "destination": "/new-page",
        "type": 301
      }
    ]
  }
}

A The user gets a 404 error because /old-page no longer exists.

B The user sees the content of /new-page but the URL stays /old-page.

C The user is permanently redirected to /new-page with a 301 status code.

D The user is temporarily redirected to /new-page with a 302 status code.

💡 Hint

Think about what a 301 redirect means in web hosting.

A 301 redirect tells browsers and search engines that the page has permanently moved to a new URL. So visiting /old-page sends the user to /new-page and updates the URL in the browser.

❓ Configuration

intermediate

Firebase Hosting Rewrite Rule Effect

Consider this Firebase Hosting rewrite rule:

{
  "hosting": {
    "rewrites": [
      {
        "source": "/app/**",
        "destination": "/index.html"
      }
    ]
  }
}

What happens when a user visits /app/profile?

A The user is redirected to /index.html and the URL changes to /index.html.

B The user is served the content of /index.html but the URL remains /app/profile.

C The user gets a 404 error because /app/profile does not exist.

D The user is served the content of /app/profile if it exists, otherwise a 404.

💡 Hint

Rewrite rules serve a file without changing the URL in the browser.

Rewrite rules serve the specified destination file for matching URLs but keep the original URL in the browser. So /app/profile serves /index.html content without URL change.

❓ Architecture

advanced

Combining Redirects and Rewrites in Firebase Hosting

You want to permanently redirect all requests from /blog-old/** to /blog-new/**, but also rewrite all /blog-new/** requests to /blog/index.html for your single-page app. Which configuration achieves this?

A

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog-new/**", "type": 301}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

B

{
  "rewrites": [
    {"source": "/blog-old/**", "destination": "/blog-new/**"},
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

C

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog/index.html", "type": 301}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

D

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog-new/**", "type": 302}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

💡 Hint

Redirects change the URL in the browser; rewrites serve files without changing the URL.

Option A correctly uses a 301 redirect to permanently send /blog-old/** requests to /blog-new/** URLs, then rewrites /blog-new/** requests to serve /blog/index.html content without changing the URL.

❓ security

advanced

Security Implications of Firebase Hosting Redirects

Which Firebase Hosting redirect configuration could cause an open redirect vulnerability?

{
  "redirects": [
    {
      "source": "/goto",
      "destination": "https://example.com",
      "type": 302
    }
  ]
}

A Redirecting to an external URL based on user input without validation can cause open redirect vulnerabilities.

B Using a 302 redirect always prevents open redirect vulnerabilities.

C Redirecting only within the same domain can cause open redirect vulnerabilities.

D Redirecting to a fixed external URL like https://example.com is safe and does not cause open redirect issues.

💡 Hint

Think about what happens if the destination URL is dynamic and user-controlled.

Open redirect vulnerabilities happen when attackers can control the redirect destination, leading users to malicious sites. Fixed redirects like in the example are safe, but dynamic redirects without validation are risky.

✅ Best Practice

expert

Optimizing Firebase Hosting Rules for Performance

You have many redirect and rewrite rules in your Firebase Hosting config. Which practice improves performance and reduces rule conflicts?

A Use only redirects and avoid rewrites to simplify the config.

B Place general wildcard rules before specific rules to catch all requests early.

C Combine all redirects and rewrites into a single rule to reduce file size.

D Place more specific rules before general wildcard rules to ensure correct matching order.

💡 Hint

Order of rules affects which rule matches first.

Firebase Hosting processes rules top to bottom. Specific rules should come first to match exact paths before general wildcards catch everything else. This avoids conflicts and improves performance.

Practice

1. What is the main difference between a redirect and a rewrite in Firebase Hosting?

easy

A. Redirect changes the browser URL, rewrite does not change the URL shown.

B. Rewrite changes the browser URL, redirect does not change the URL shown.

C. Both redirect and rewrite always change the browser URL.

D. Neither redirect nor rewrite affect the browser URL.

Solution

1. Step 1: Understand redirect behavior

   A redirect sends the user to a new URL and updates the browser address bar to show this new URL.

2. Step 2: Understand rewrite behavior

   A rewrite serves different content but keeps the original URL visible in the browser address bar.

3. Final Answer:

   Redirect changes the browser URL, rewrite does not change the URL shown. -> Option A

4. Quick Check:

   Redirect updates URL, rewrite keeps URL same [OK]

Hint: Redirect changes URL, rewrite hides content change [OK]

Common Mistakes:

• Confusing redirect with rewrite behavior
• Thinking rewrite changes browser URL
• Assuming redirect does not update URL

2. Which of the following is the correct Firebase Hosting syntax to redirect from /old-page to /new-page?

easy

A. "redirect": [{"source": "/old-page", "destination": "/new-page"}]

B. "rewrites": [{"source": "/old-page", "destination": "/new-page"}]

C. "rewrites": [{"source": "/old-page", "type": 301, "destination": "/new-page"}]

D. "redirects": [{"source": "/old-page", "destination": "/new-page", "type": 301}]

Solution

1. Step 1: Identify redirect syntax

   Redirects require a source, destination, and a type (like 301 for permanent redirect).

2. Step 2: Check options for correct syntax

   "redirects": [{"source": "/old-page", "destination": "/new-page", "type": 301}] correctly includes source, destination, and type 301. Others miss type or use rewrites incorrectly.

3. Final Answer:

   "redirects": [{"source": "/old-page", "destination": "/new-page", "type": 301}] -> Option D

4. Quick Check:

   Redirect needs type code like 301 [OK]

Hint: Redirects need a type code (301 or 302) [OK]

Common Mistakes:

• Omitting the redirect type code
• Using rewrites instead of redirects for URL change
• Placing type in rewrites block

3. Given this Firebase Hosting config snippet:

{
  "rewrites": [
    {"source": "/app/**", "destination": "/index.html"}
  ]
}

What happens when a user visits /app/profile?

medium

A. The browser URL stays /app/profile but serves content from /index.html.

B. The browser URL changes to /index.html and shows that page.

C. The browser URL changes to /app/index.html and shows that page.

D. The browser returns a 404 error because /app/profile does not exist.

Solution

1. Step 1: Understand rewrite with wildcard

   The rewrite rule matches any URL starting with /app/ and serves /index.html content without changing the URL.

2. Step 2: Apply to /app/profile

   Visiting /app/profile triggers the rewrite, so content from /index.html is served but URL remains /app/profile.

3. Final Answer:

   The browser URL stays /app/profile but serves content from /index.html. -> Option A

4. Quick Check:

   Rewrite serves content without URL change [OK]

Hint: Rewrite serves content but keeps URL same [OK]

Common Mistakes:

• Thinking rewrite changes the URL
• Expecting 404 error for unmatched files
• Assuming redirect happens instead of rewrite

4. You wrote this Firebase Hosting config:

{
  "redirects": [
    {"source": "/home", "destination": "/index.html"}
  ]
}

But the redirect does not work as expected. What is the problem?

medium

A. Using redirects instead of rewrites for serving index.html.

B. The source path should be /home/** to match all subpaths.

C. Missing the redirect type (301 or 302) in the redirect rule.

D. The destination should be a full URL, not a relative path.

Solution

1. Step 1: Analyze the redirect behavior

   A redirect requires a type (301 or 302) to work properly. Missing the type causes the redirect to fail.

2. Step 2: Identify the likely expectation and fix

   Adding the redirect type (301 or 302) will fix the redirect. Using rewrites is an alternative if you want to serve content without changing the URL.

3. Final Answer:

   Missing the redirect type (301 or 302) in the redirect rule. -> Option C

4. Quick Check:

   Redirect requires type code [OK]

Hint: Redirects need a type code (301 or 302) [OK]

Common Mistakes:

• Using redirects instead of rewrites to preserve URL
• Confusing redirects with rewrites
• Using relative paths incorrectly

5. You want to support a single-page app on Firebase Hosting where all URLs under /app/ show index.html content without changing the URL, but also redirect /old-app permanently to /app/. Which config snippet correctly achieves this?

hard

A. {
"rewrites": [
{"source": "/old-app", "destination": "/app/"},
{"source": "/app/**", "destination": "/index.html"}
]
}

B. {
"redirects": [
{"source": "/old-app", "destination": "/app/", "type": 301}
],
"rewrites": [
{"source": "/app/**", "destination": "/index.html"}
]
}

C. {
"redirects": [
{"source": "/old-app/**", "destination": "/app/", "type": 302}
],
"rewrites": [
{"source": "/app/**", "destination": "/index.html"}
]
}

D. {
"redirects": [
{"source": "/old-app", "destination": "/index.html", "type": 301}
],
"rewrites": [
{"source": "/app/**", "destination": "/app/"}
]
}

Solution

1. Step 1: Redirect /old-app to /app/ permanently

   Use a redirect with type 301 from /old-app to /app/ to update browser URL.

2. Step 2: Rewrite all /app/** URLs to serve index.html without changing URL

   Use a rewrite rule matching /app/** to serve /index.html content while keeping URL unchanged.

3. Step 3: Verify option correctness

   { "redirects": [ {"source": "/old-app", "destination": "/app/", "type": 301} ], "rewrites": [ {"source": "/app/**", "destination": "/index.html"} ] } correctly combines a 301 redirect and a rewrite for SPA support. Others misuse rewrites or redirect types.

4. Final Answer:

   { "redirects": [ {"source": "/old-app", "destination": "/app/", "type": 301} ], "rewrites": [ {"source": "/app/**", "destination": "/index.html"} ] } -> Option B

5. Quick Check:

   Redirect updates URL, rewrite serves SPA content [OK]

Hint: Redirect for URL change, rewrite for SPA content [OK]

Common Mistakes:

• Using rewrite instead of redirect for URL change
• Missing redirect type or using wrong type
• Rewriting to wrong destination path