Single sign on using only Firebase

Question

I have two domains using the same Firebase backend instance. We are using Firebase Email & Password auth only (we have no backend). Is it possible to allow users to roam between domains without forcing them to login again? One thought is that when a logged in user is redirected to the other domain, we pass the JWT in the URL, then use it to automatically login on the other domain. Would that be workable? Are there any security concerns there?

Answer 1

JWT tokens that Firebase generates are specific to that Firebase app, but not specific to any domain. So as long as you use a secure way to pass the token from page to page, you can re-use them.