CODEWITHSUNDEEP
androidfirebasefirebase-authentication
Rafael Lima
Rafael Lima

Reputation: 3535

how to handle firebaseauth token expiration?

I use firebase 2 years so far and was never clear to me how to handle firebasse auth token expiration.

I'm using android and once i do FirebaseAuth.getInstance().signInWithCustomToken(token); interanally firebase receives a message like that:

{
   "t":"d",
   "d":{
      "r":5,
      "b":{
         "s":"ok",
         "d":{
            "auth":{
               "uid":"test",
               "token":{
                  "exp":1592230969,
                  "user_id":"test",
                  "iat":1592227369,
                  "sub":"test",
                  "aud":"test",
                  "auth_time":1592227369,
                  "iss":"https://securetoken.google.com/igibo-b0b27",
                  "firebase":{
                     "identities":{

                     },
                     "sign_in_provider":"custom"
                  }
               },
               "provider":"custom",
               "user_id":"test"
            },
            "expires":1592230969
         }
      }
   }
}

after this request any future calls to FirebaseAuth.getInstance().getCurrentUser() will return info about this authenticated user.
It is clean in this json that this auth token expires sometime, but it isn't clear to me what will be firebase behaviors for that...

will FirebaseAuth.getInstance().getCurrentUser() return null after token expiration?
will firebase automatially renew the token so it never expires?
if i need to monitore and revalidate token manually HOW I DO THAT?

if im not debugging i cant even find the information of expiration anywhere.

Upvotes: 3

Views: 15966

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 598668

Firebase Authentication tokens expire an hours after they are created. Firebase SDKs automatically refresh the token after about 55 minutes, which means you usually don't have to do anything yourself. The current user will only become null if the token can't be refreshed, for example if the account has been disabled on the server.

Upvotes: 7

Related Questions