I'm reading Best practices for FCM registration token management and have qustions regarding token handling on server
From their docs:
We strongly recommend implementing a token timestamp in your code and your servers, and updating this timestamp at regular intervals. This timestamp must be implemented by your code and your servers, as it is not provided for you by FCM SDKs
Does "implementing a token timestamp in your code" mean generating a timestamp and storing it alongside my token in the database and checking refreshing timestamp each time a token is used?
So the token-related flow in my opinion should be as follows:
- client app generates firebase token and passes it to the backend where it is stored along with a timestamp (e.g. now + 5 days)
- when process that triggers push notification happens the token is extracted from the database and stored timestamp is compared to current timestamp.
- if current timestamp is greater then stored timestamp, the token is considered invalid, so I perform
FirebaseAuth.getInstance(myapp).revokeRefreshTokens(token); - otherwise timestamp is updated and stored back to the database and token is used to send push
- the api should also contain an endpoint to check if token is not expired, if it is not expired the timestamp is updated, othervise an error is returned
Please, correct me if I made some mistakes.