Firebase with Next.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Next.js handle Firebase client SDK initialization?

In a Next.js app using Firebase client SDK, what is the best way to initialize Firebase to avoid multiple instances during hot reloads?

Firebase

import { initializeApp, getApps } from 'firebase/app';

const firebaseConfig = { /* config */ };

const app = !getApps().length ? initializeApp(firebaseConfig) : getApps()[0];

export default app;

A Initialize Firebase only on the server side and never on the client.

B Initialize Firebase inside a React component directly without checking existing apps.

C Initialize Firebase once globally and reuse the instance by checking if apps exist.

D Initialize Firebase multiple times in different files without sharing the instance.

💡 Hint

Think about how Next.js hot reloads can cause multiple initializations.

Next.js hot reloads can cause the Firebase app to initialize multiple times if not checked. Using getApps() to check existing instances prevents this.

❓ Architecture

intermediate

Where should Firebase Admin SDK be used in a Next.js app?

In a Next.js app, where is the correct place to use Firebase Admin SDK for secure server-side operations?

A In static files served to the client.

B Inside API routes or server-side functions only.

C Directly in the browser JavaScript code.

D Inside React components rendered on the client side.

💡 Hint

Consider security and environment where Admin SDK can safely run.

Firebase Admin SDK requires server-side environment and should only be used in API routes or server-side functions to keep credentials secure.

❓ Configuration

advanced

What is the correct way to protect Firebase API keys in a Next.js app?

Given Firebase API keys are public by design, how should you protect sensitive Firebase operations in Next.js?

A Use Firebase client SDK on the client and restrict sensitive operations to server-side API routes with Admin SDK.

B Store API keys in environment variables and never expose them to the client.

C Hardcode API keys in client-side code but obfuscate them with base64 encoding.

D Use Firebase API keys only in serverless functions and never initialize Firebase on the client.

💡 Hint

Think about what Firebase API keys protect and how Firebase security rules work.

Firebase API keys are not secret. Sensitive operations should be done server-side with Admin SDK. Client SDK uses API keys but security is enforced by Firebase rules.

🧠 Conceptual

advanced

What happens if you call Firebase client SDK inside getStaticProps in Next.js?

Consider calling Firebase client SDK methods inside getStaticProps in Next.js. What is the expected behavior?

Firebase

import { initializeApp } from 'firebase/app';
import { getFirestore, collection, getDocs } from 'firebase/firestore';

const firebaseConfig = { /* config */ };

export async function getStaticProps() {
  const app = initializeApp(firebaseConfig);
  const db = getFirestore(app);
  const snapshot = await getDocs(collection(db, 'posts'));
  return { props: { posts: snapshot.docs.map(doc => doc.data()) } };
}

A It causes runtime errors because client SDK depends on browser APIs not available at build time.

B It fetches data but with slower performance than Admin SDK.

C It works fine because getStaticProps runs on the server at build time.

D It fetches data but exposes Firebase credentials to the client.

💡 Hint

Think about environment differences between client SDK and server-side functions.

Firebase client SDK relies on browser APIs like IndexedDB and window, which are not available during Next.js build time, causing errors.

❓ security

expert

How to securely implement Firebase Authentication with Next.js API routes?

You want to verify Firebase ID tokens sent from the client in Next.js API routes. Which approach is correct?

Firebase

import { getAuth } from 'firebase-admin/auth';

export default async function handler(req, res) {
  const idToken = req.headers.authorization?.split('Bearer ')[1];
  try {
    const decodedToken = await getAuth().verifyIdToken(idToken);
    res.status(200).json({ uid: decodedToken.uid });
  } catch (error) {
    res.status(401).json({ error: 'Unauthorized' });
  }
}

A Skip token verification and rely on Firebase security rules only.

B Verify ID tokens on the client side only and trust client validation.

C Send ID tokens to third-party services for verification outside Next.js.

D Verify ID tokens in API routes using Firebase Admin SDK's verifyIdToken method.

💡 Hint

Consider where token verification should happen for secure backend validation.

Firebase ID tokens must be verified on the server using Admin SDK to ensure requests are authenticated and authorized.