1

I use the PWA starter kit https://pwa-starter-kit.polymer-project.org/ to create websites. I host the sites on Google App Engine because it is very easy to host with and delivers the PRPL pattern right out of the box https://pwa-starter-kit.polymer-project.org/building-and-deploying#building-for-prpl-server.

However, in my new project I am using a separate subdomain for each client. And each client will have a different tenant id in my firebase database. My question is: can I intercept the http request for the PWA with a cloud function and retrieve the tenant id for the client from my database based on the requested subdomain?

In the past when I hosted everything with firebase (functions and hosting) I was able to add this to the firebase.json to redirect the http request for the PWA to a firebase function I called "renderApp"

"rewrites": [
  {
    "source": "**",
    "function": "renderApp"
  }

How can I achieve this same effect while using the Google App Engine to host my PWA? I assume there is someway, but since I don't have a firebase.json anymore I am not sure how to do it.

In short; I would like to have the tenant id baked into my PWA when I send it out to the client, but I have to look up my tenant id located in my firebase database first (based on the subdomain from the http request)

Gilberg
  • 2,514
  • 4
  • 31
  • 41

1 Answers1

0

Disclaimer: I have an answer for you, but also a warning at the end of this answer.

First, make sure you've set up *.example.com as a custom subdomain in App Engine, and *.example.com is configured as a CNAME with your DNS provider. That will route all requests to TENANT.example.com to your application. (I'm assuming that the subdomain represents your tenant id).

In your application, you can pull the subdomain from the Host header. In nodejs, that would look something like:

const host = req.get('Host');
const [ tenant, ] = host.split('.');

This will solve your problem, but keep in mind that you really only want to discern the tenant_id from an authenticated user. You could integrate Identity-Aware Proxy or a custom auth solution. Relying only on subdomain is a somewhat flimsy method to achieve what I think you're trying to do, and allows any client to probe for flaws that may provide access to the data of other tenants. Make sure you're only using the subdomain for cosmetic, white-labeling purposes, and not as part of an authentication strategy.

See also:

Travis Webb
  • 14,688
  • 7
  • 55
  • 109