Sample Firebase hosting configuration for Flutter web.

firebase.json

{
  "hosting": {
    "public": "build/web",
    "ignore": [
      "firebase.json",
      "**/.*",
      "**/node_modules/**"
    ],
    "headers": [
      {
        "source": "**/*",
        "headers": [
          {
            "key": "Cross-Origin-Embedder-Policy",
            "value": "credentialless"
          },
          {
            "key": "Cross-Origin-Opener-Policy",
            "value": "same-origin"
          },
          {
            "key": "Cache-Control",
            "value": "no-cache, no-store, must-revalidate"
          }
        ]
      },
      {
        "source":
          "**/*.@(jpg|jpeg|gif|png|svg|webp|css|eot|otf|ttf|ttc|woff|woff2|font.css)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "max-age=3600,s-maxage=604800"
          }
        ]
      },
      {
        "source":
          "**/*.@(mjs|js|wasm|json)",
        "headers": [
          {
            "key": "Cache-Control",
            "value": "max-age=0,s-maxage=604800"
          }
        ]
      }
    ]
  }
}

Cache

• Normal assets are configured to be cached for 1h + 7 days across the CDN (the latter is invalidated by firebase hosting when doing a refresh)
• Application code (js/mjs/wasm/json) is set to expire immediately, to leverage Etag revalidation. This can be raised to something less aggressive, like 5 minutes (300) or a good tradeoff for your deployment cadence.
• Everything else (html files, other extension types) are set to not be cached at all.

In all cases, exceptions for specific files can be made, like the (non-existent in Flutter web font.css file).

Wasm

This gist also adds COEP/COOP (Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy so shared array buffers become available, and Wasm can work in multi-threaded mode)