↑ ↓ navigate↵ selectesc close

Server Value Expressions for Data Connect in Firebase: Web Architecture & Implementation Guide

CodingCat.dev tutorial cover image
Alex Patterson
Alex Patterson

For years, choosing Firebase meant trading away relational SQL joins, strict foreign keys, and pgvector similarity search in favor of NoSQL document denormalization. Following the announcement of Server Value Expressions for Data Connect by Andrea Wu on the Official Firebase Blog (2025-06-05), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement.

The Mental Model: Why Server Value Expressions for Data Connect Matters for Web Devs

As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase Data Connect bridges that gap by pairing a managed Google Cloud SQL for PostgreSQL instance with a declarative GraphQL schema compiler that automatically generates type-safe TypeScript, React, and Angular SDKs alongside server-enforced @auth directives.

AJ Pro-Tip from Alex: Keep your authorization logic inside your Data Connect GraphQL operations using @auth(level: USER) and server-evaluated expressions like auth.uid and request.time rather than trusting client-supplied user IDs in query variables.

How It Works: Technical Breakdown & Implementation

When using Data Connect, your app sometimes might need server-computed values because the values need to be computed at the time of data creation.

As an example, suppose you’re adding a user field to AddReview, and you want to set the field to the current user ID when a review is added. You could add a variable and change the app to set it from the client side, but an attacker may leverage that to post reviews attributed to another user. It’s a lot of work to ensure security.

With Data Connect, you only have to change the server side by using server values. This means the server dynamically populates fields in your tables using stored or readily-computable values using particular server-side expressions.

Data Connect already supported some server values, and now, there are even more server values that you can use!

Previously

Until now, the only supported server values were: auth.uid, request.time, and uuidV4(). As an example, you could define a field with a timestamp applied when the field is accessed using the expression createdAt: Timestamp! @default(expr: "request.time").

This might be used when a user creates their account, so the schema could look like this:

type
  # other fields
  userId: 
  createdAt: 
}

This schema not only means that the corresponding database table gets created but also that the server automatically fills in the correct values.

To use these in your queries or mutations, you use <field>_expr, which are auto-generated on all fields. For example, to add a user:

mutation
  user_insert(data: {
    userId_expr
    createdAt_expr
  })
}

New Updates

The supported server values above still work, but now, you can use CEL expressions to make more complex field values.

To do so, you use <field>_expr, which are auto-generated on all fields. The schema stays the same as above, and to add a user:

mutation
  user_insert(data: {
    userId_expr
    createdAt_expr
  })
}

Without using _expr, auth.token.email and request.time will be string literals (meaning userId’s value will have the literal value “auth.token.email”. createdAt will not hold the correct value, as the literal “request.time” string parses into a specific Timestamp and will be that value every single time).

Aside from the expressions that worked before today, you can now create even more complex fields! Let’s say you need to add a prefix to all userIDs located in a specific region. With server values, this is how you can do so:

mutation
  user_insert(data: {
    userId_expr
  })
}

If the auth.uid is abc123, the userId for this particular user will be USabc123.

Note: to ensure proper computation of the expression, you need to wrap the entire expression in double quotes and use single quotes inside the expression.

For a more interesting example, let’s say you’re building a medical app with doctors creating profiles and you’re using Firebase Auth to authenticate:

type
  id: 
  displayName: 
}

You want to add a new user with their Firebase Auth UID as the ID:

mutation
  profile_insert(data: {
    id_expr
  })
}

When a doctor fills out profile information, they provide their degree, like MD, DO, PA, NP, and MA. In displaying this information to clients, the app needs to list this degree after the name. Therefore in the app code, each new profile insertion also needs to include their name, concatenated with a comma and their degree. Adding to the code above, you can use a CEL expression value in displayName_expr to do name concatenation:

mutation
  profile_insert(
    data: {
      id_expr
      displayName_expr
    }
  )
}

vars above is shorthand for request.variables to make writing code easier and succinct. There is no advantage in request.variables as it’s longer and these two get the exact same information.

Later, let’s say a user has saved the name of the doctor and degree they have, and the user wants to see the doctor’s profile. To query for results for the correct doctor:

query
  profiles(
    where: { 
      id
      displayName
    }
  )
}

With <field>_expr being able to evaluate CEL expressions, you have a lot more options for server values!

Production Web Architecture & Security Checklist

Whether we are deploying on Firebase App Hosting, Cloudflare Workers, or Vercel, shipping SQL features to production requires defense-in-depth across three layers:

  • Enforce Firebase App Check & Attestation: Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using Firebase App Check with reCAPTCHA Enterprise.
  • Validate Locally with the Firebase Emulator Suite: Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production.
  • Keep Server & Client Boundaries Type-Safe: Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers.

Conclusion

Accelerate your full-stack web and AI development by pairing Server Value Expressions for Data Connect with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on X (@CodingCatDev) and LinkedIn (CodingCat.dev) how you are using Firebase in your stack, and subscribe to the CodingCat.dev YouTube Channel so you don't miss what we build next!

Watch Our Related Firebase Video Tutorial on YouTube

Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session Firebase SQL with Data Connect below, and make sure to Subscribe to CodingCat.dev on YouTube for weekly full-stack web and AI deep dives:

Resources, Official Docs & Related CodingCat.dev Guides

Frequently Asked Questions (FAQ)

What are the key capabilities introduced in Server Value Expressions for Data Connect?

Server Value Expressions for Data Connect (announced 2025-06-05 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, SQL, TypeScript, Security workloads. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement. Developers can review the primary announcement on the Firebase Blog alongside our implementation patterns and production checklist above.

How do web developers use Server Value Expressions for Data Connect with Next.js, SvelteKit, React, or Angular?

Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and Firebase App Hosting. Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying.

Where can I watch video tutorials on Firebase Web and AI development?

You can watch our hands-on Firebase video walkthroughs on the CodingCat.dev YouTube Channel, including Firebase SQL with Data Connect, and follow us on X (@CodingCatDev) for weekly full-stack tutorials.