Best practices for backend token handling in Firbase Cloud Messaging

Viewed 190

I'm reading Best practices for FCM registration token management and have qustions regarding token handling on server

From their docs:

We strongly recommend implementing a token timestamp in your code and your servers, and updating this timestamp at regular intervals. This timestamp must be implemented by your code and your servers, as it is not provided for you by FCM SDKs

Does "implementing a token timestamp in your code" mean generating a timestamp and storing it alongside my token in the database and checking refreshing timestamp each time a token is used?

So the token-related flow in my opinion should be as follows:

  1. client app generates firebase token and passes it to the backend where it is stored along with a timestamp (e.g. now + 5 days)
  2. when process that triggers push notification happens the token is extracted from the database and stored timestamp is compared to current timestamp.
  3. if current timestamp is greater then stored timestamp, the token is considered invalid, so I perform FirebaseAuth.getInstance(myapp).revokeRefreshTokens(token);
  4. otherwise timestamp is updated and stored back to the database and token is used to send push
  5. the api should also contain an endpoint to check if token is not expired, if it is not expired the timestamp is updated, othervise an error is returned

Please, correct me if I made some mistakes.

0 Answers
Related