Firebase Hosting Headers: Cache, Security, CORS Config
The headers block in firebase.json controls cache TTL, security policy, and CORS. Copy the minimum config that ships fast and safe, and skip the patterns that silently break your whole site.
Articles tagged with #Firebase
The headers block in firebase.json controls cache TTL, security policy, and CORS. Copy the minimum config that ships fast and safe, and skip the patterns that silently break your whole site.
Firestore reads, Functions invocations, Hosting bandwidth — each free-tier metric has a hard line. Here's how to find which one tripped and stop the bleeding.
Firestore throws FAILED_PRECONDITION because a multi-field where + orderBy needs a composite index. The fastest fix, the CLI workflow, and how to confirm it's built.
Same domain binds fine on Vercel but Firebase Hosting stays Pending or never gets SSL. The exact DNS records Firebase needs, what to remove, and how to confirm the fix.
15 copy-ready prompts to audit Firebase Security Rules, indexes, Cloud Functions, Auth, and App Check — updated for 2nd-gen functions (June 2026).
Deploy a static Astro site to Firebase Hosting the right way: the firebase.json config, cache headers, clean URLs, and the SPA-rewrite trap that breaks your 404s.
Ship a static site (Astro, Vite, Hugo, plain HTML) to Firebase Hosting in about 10 minutes — free SSL, custom domain, cache headers, and the macOS port-5000 fix. Verified June 2026.
Deployed but visitors still see the old page? Fix it with this firebase.json cache-header config, a curl diagnostic, and the correct rollback command (verified June 2026).
Point your domain at Firebase Hosting with the exact TXT, A and AAAA records, dig verification commands, and fixes for the Needs setup loop and stuck SSL.
Firebase's Spark free tier gives 10 GB storage + 10 GB/month transfer (a 360 MB/day soft cap). Use this page-weight math, real Blaze rates, and budget config to know if you fit.
A reproducible 10-step pre-launch checklist for Firebase Hosting (June 2026): firebase.json, custom-domain DNS, SSL timing, cache headers, redirects, sitemap, and a rehearsed rollback.
Firebase Hosting rewrites map URLs to a Cloud Function, Cloud Run, or a single-page app. The three patterns that actually work as of June 2026, the modern functionId syntax, and the traps each one hides.
Pages work locally but 404 on Firebase Hosting. Diagnose it in ten minutes with the exact request priority order, firebase.json snippets, and curl commands that pinpoint the cause.
Firebase Hosting is Google's static + edge CDN. Here is when it fits vs the newer App Hosting, the free-tier limits, a baseline firebase.json, and deploy commands.
firebase deploy fails with 403 or "caller does not have permission"? Diagnose the identity chain — account, project, IAM roles, CI auth — and fix it fast.
A callable returns "not found" even though the console shows it. Diagnose region, name, and deploy state in minutes.
Fix firebase deploy --only hosting: CLI version, expired auth, wrong public path, or Spark quota.
Homepage works but /about or a refreshed /blog/post returns 404 on Firebase Hosting? It's almost always firebase.json rewrites. Verified fixes for SPA, SSG, Astro, and Next.js as of June 2026.
Your firebase.json rewrites for an SPA or Cloud Function don't trigger. Fix the order, region, and deploy target in minutes.
Firebase Hosting vs Vercel, compared on free-tier limits, pricing, serverless, and one rule most guides skip: Vercel's free Hobby plan bans commercial use. Verified June 2026 figures.