firebase error when deleting user account "This operation is sensitive and requires recent authentication. Log in again before retrying this request."

user_11431595 0
Viewed 10038

When I want to delete a firebase user account in my application, the operation passes normally if the user has recently logged but after a period of time if I try to delete the user I get this error "This operation is sensitive and requires recent authentication. Log in again before retrying this request." Normally the firebase refresh the user session automatically but I didn't find why he want the user to log again and even the value of Auth.auth().currentUser is not nil. Thank you for your help ! this is my code to delete the user account : 

@objc func deleteAccountAction(){
self.showProgressView()
let user = Auth.auth().currentUser
let id=Auth.auth().currentUser?.uid
self.refProducts.child(id!).removeValue { error, _ in
    if(error != nil){
        print("firebase remove error")
        print(error?.localizedDescription.description ?? nil)
        self.dismissHUD(isAnimated: true)
    }
    else{
        self.refUsers.child(id!).removeValue { error, _ in
            if(error != nil){
                print("firebase remove error")
                print("error while deleting user from firebase: "+error!.localizedDescription)
                self.dismissHUD(isAnimated: true)    
            }
            else {

                user?.delete { error in
                    if  error != nil {
                        print("error while deleting user:" + error!.localizedDescription)
                        self.dismissHUD(isAnimated: true)
                    } else {

                       UserDefaults.standard.removeObject(forKey: "USER_UID")
                                                                               UserDefaults.standard.synchronize
                                    self.dismissHUD(isAnimated: true)
                                    let nextVC = self.storyboard?.instantiateViewController(withIdentifier: "StartingViewController") as! StartingViewController
                                    nextVC.isAccoundDeleted=true
                                    GlobalVar.user=nil
                                    self.navigationController?.pushViewController(nextVC, animated: true)
                        }
                    }
                }
            }
        }
    }
}
firebase-authentication firebase swift
4 Answers

For certain sensitive operations (such as changing the user's password, or deleting the user account), Firebase requires that the user has recently signed in. If the user hasn't signed in recently when you try to perform such an operation, Firebase throws the exception you get.

When you get this exception, you should ask the user to re-enter their credentials, and retry the operation.

From the documentation on handling errors:

[Deleting a user account] is a security sensitive operation that requires a recent login from the user. This error indicates the user has not signed in recently enough. To resolve, reauthenticate the user by invoking reauthenticateWithCredential:completion: on FIRUser.

user_2091030

In addition to Frank van's answer, time span for that is 5 minutes. After 5 minutes of login you cannot do such operations.

you can refer FIRAuthErrorCode (check out error code 17014 : FIRAuthErrorCodeRequiresRecentLogin = 17014)

user_83510610

Here is a workaround: Make a call to a cloud function that performs the user account deletion and sign out the client. You must ensure proper guards for this cloud function so that it is not maliciously used.

Show courtesy to your users. Offer them with a proper dialog showing that this is irreversible and all relevant user data will be deleted permanently. Only call the function if the user accepts the consequences.

user_158183330

What you can do (its probably the most easy way) is to save login and password of the user in the local storage when they log in first time (for example using AsyncStorage) and once they want to delete the account log them in again without needing them to reenter credentials shortly before you delete the account. They wont even noticed you logged them in again before deleting the account.

Im not a security expert but the password and email would be stored localy without access to the outside world so I do not see any concerns about security issues there.

Once you delete the app, the local storage is gone anyways, at least with AsyncStorage. Once you logout a user and use another account, the new account credentials would overwrite the old ones from the local storage.

user_88806500
Related