Redirect and rewrite rules in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Firebase Hosting Redirect Behavior

Given the following Firebase Hosting redirect rule, what will happen when a user visits /old-page?

{
  "hosting": {
    "redirects": [
      {
        "source": "/old-page",
        "destination": "/new-page",
        "type": 301
      }
    ]
  }
}

A The user gets a 404 error because /old-page no longer exists.

B The user sees the content of /new-page but the URL stays /old-page.

C The user is permanently redirected to /new-page with a 301 status code.

D The user is temporarily redirected to /new-page with a 302 status code.

💡 Hint

Think about what a 301 redirect means in web hosting.

A 301 redirect tells browsers and search engines that the page has permanently moved to a new URL. So visiting /old-page sends the user to /new-page and updates the URL in the browser.

❓ Configuration

intermediate

Firebase Hosting Rewrite Rule Effect

Consider this Firebase Hosting rewrite rule:

{
  "hosting": {
    "rewrites": [
      {
        "source": "/app/**",
        "destination": "/index.html"
      }
    ]
  }
}

What happens when a user visits /app/profile?

A The user is redirected to /index.html and the URL changes to /index.html.

B The user is served the content of /index.html but the URL remains /app/profile.

C The user gets a 404 error because /app/profile does not exist.

D The user is served the content of /app/profile if it exists, otherwise a 404.

💡 Hint

Rewrite rules serve a file without changing the URL in the browser.

Rewrite rules serve the specified destination file for matching URLs but keep the original URL in the browser. So /app/profile serves /index.html content without URL change.

❓ Architecture

advanced

Combining Redirects and Rewrites in Firebase Hosting

You want to permanently redirect all requests from /blog-old/** to /blog-new/**, but also rewrite all /blog-new/** requests to /blog/index.html for your single-page app. Which configuration achieves this?

A

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog-new/**", "type": 301}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

B

{
  "rewrites": [
    {"source": "/blog-old/**", "destination": "/blog-new/**"},
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

C

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog/index.html", "type": 301}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

D

{
  "redirects": [
    {"source": "/blog-old/**", "destination": "/blog-new/**", "type": 302}
  ],
  "rewrites": [
    {"source": "/blog-new/**", "destination": "/blog/index.html"}
  ]
}

💡 Hint

Redirects change the URL in the browser; rewrites serve files without changing the URL.

Option A correctly uses a 301 redirect to permanently send /blog-old/** requests to /blog-new/** URLs, then rewrites /blog-new/** requests to serve /blog/index.html content without changing the URL.

❓ security

advanced

Security Implications of Firebase Hosting Redirects

Which Firebase Hosting redirect configuration could cause an open redirect vulnerability?

{
  "redirects": [
    {
      "source": "/goto",
      "destination": "https://example.com",
      "type": 302
    }
  ]
}

A Redirecting to an external URL based on user input without validation can cause open redirect vulnerabilities.

B Using a 302 redirect always prevents open redirect vulnerabilities.

C Redirecting only within the same domain can cause open redirect vulnerabilities.

D Redirecting to a fixed external URL like https://example.com is safe and does not cause open redirect issues.

💡 Hint

Think about what happens if the destination URL is dynamic and user-controlled.

Open redirect vulnerabilities happen when attackers can control the redirect destination, leading users to malicious sites. Fixed redirects like in the example are safe, but dynamic redirects without validation are risky.

✅ Best Practice

expert

Optimizing Firebase Hosting Rules for Performance

You have many redirect and rewrite rules in your Firebase Hosting config. Which practice improves performance and reduces rule conflicts?

A Use only redirects and avoid rewrites to simplify the config.

B Place general wildcard rules before specific rules to catch all requests early.

C Combine all redirects and rewrites into a single rule to reduce file size.

D Place more specific rules before general wildcard rules to ensure correct matching order.

💡 Hint

Order of rules affects which rule matches first.

Firebase Hosting processes rules top to bottom. Specific rules should come first to match exact paths before general wildcards catch everything else. This avoids conflicts and improves performance.