Flutter best pracices: Do I need to refresh the idtoken every time I make an HTTP Request?

user_11072782 0
Viewed 2618

I am developing front end UI with Flutter, using Firebase for Authentication and have a custom backend API to processing HTTP Requests to the DB.On the API, I pass the Firebase token and use this to authenticate the user. I know the FB token expires after 1 hour, but I'm looking for the cleanest, best practice way to ensure the user can continue to use the APP without the token expiring.

The current process I am using is to get a new token before every request in flutter:

         FirebaseUser fbuser = await FirebaseAuth.instance.currentUser();
         String mytoken = await fbuser.getIdToken(refresh: true);

However, this feels like it will unnecessarily slow down any http request. Instead, is there any client side tool /api in Dart that would allow me to verify if the token is expired? Preferably, I'd like to just store the token, and before each call, verify it isn't expired. If it is, refresh, otherwise use the current token.

What is best practice here?

firebase-authentication dart flutter
1 Answers

The Firebase SDKs refresh the ID token if it's older than 55 minutes. This gives it a window of 5 minutes to get a new ID token, before the old token expires. As soon as the new ID token is available, the clients start using that new ID token of course.

I'd say that the best practice would be to mimic what the Firebase SDKs do. :)

user_2091030
Related