In the docs it's stated that:
But once you sign a user in using signInWithCustomToken(), they will remain signed in into the device until their session is invalidated or the user signs out.
So in which conditions does Firebase declare that a session is invalid?