CODEWITHSUNDEEP
node.jsoauthfirebase-authenticationjwt
Santhosh Veer
Santhosh Veer

Reputation: 83

Extend the Expiry Time and Date in Firebase OAuth2 access JWT Token

I want To set the maximum Expiry Date and Time for Firebase OAuth2 JWT Access Token - https://firebase.google.com/docs/database/rest/auth

I tried some methods Not working. Here is the Google's Code to generate an Access Token for Firebase Real-time Database

Google APIs Node.js Client

var {google} = require("googleapis");

// Load the service account key JSON file.
var serviceAccount = require("./myfileauth.json");

// Define the required scopes.
var scopes = [
  "https://www.googleapis.com/auth/userinfo.email",
  "https://www.googleapis.com/auth/firebase.database"
];

// Authenticate a JWT client with the service account.
var jwtClient = new google.auth.JWT(
  serviceAccount.client_email,
  null,
  serviceAccount.private_key,
  scopes
);

// Use the JWT client to generate an access token.
jwtClient.authorize(function(error, tokens) {
  if (error) {
    console.log("Error making request to generate access token:", error);
  } else if (tokens.access_token === null) {
    console.log("Provided service account does not have permission to generate access tokens");
  } else {
    var accessToken = tokens.access_token;
    console.log(accessToken);
  }
});

but it's working for a Short time only I want to Increase its Expiry date and time...

Upvotes: 1

Views: 1890

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 600131

If you want to have longer-lived session tokens, I recommend looking into session cookies. These can be created from the Firebase Admin SDK, and list this as one advantage:

Ability to create session cookies with custom expiration times ranging from 5 minutes to 2 weeks.

It works by taking the ID token (from the client) that is part of the normal Firebase authentication flow, and exchanging that for a session cookie (on the server) with:

// Set session expiration to 5 days.
const expiresIn = 60 * 60 * 24 * 5 * 1000;
// Create the session cookie. This will also verify the ID token in the process.
// The session cookie will have the same claims as the ID token.
// To only allow session cookie setting on recent sign-in, auth_time in ID token
// can be checked to ensure user was recently signed in before creating a session cookie.
admin.auth().createSessionCookie(idToken, {expiresIn}).then((sessionCookie) => { ...

Upvotes: 1

Related Questions