Firebase login with custom auth token does not expire after 1 hour

user_1291122 0
Viewed 487

I have a react app where I am able to login with custom token as follows:

  await firebase.auth().signInWithCustomToken(tokenResp.token);

As per this, firebase custom jwt have one hour expiry. And this is what I expect.

But when I make calls to collections that require authentication(i.e. request.auth!=null via firestore rules) after 1 hour, I am able to access them. I would expect the firebase instance to fail(automoatically) after one hour for these calls.

So why is it happening and how do I fix it?

Also note that I have logged in the jwt used to authenticate and clearly the expiry date is one hour by looking at the exp field in jwt decoder.

firebase-security jwt google-cloud-firestore firebase-authentication
1 Answers

When the documentation states that the Custom Token (tokenResp.token in your case) is valid for one hour, it means that the signInWithCustomToken call must happened within one hour after token creation. Once the user is "signed in" (using any of the signInXXX methods), they get an access token and a refresh token, which can be used indefinitely until sign-out or revocation.

It sounds like you're trying to use Security Rules to limit access to users who have signed in within the last hour. To achieve that, inspect the auth.token.auth_time field which contains when the user has authenticated (in seconds since epoch). For example: request.time < timestamp.value(auth.token.auth_time * 1000) + duration.time(1, 'h') evaluates to true if the request time is within one hour of sign-in time. You can use that in place of request.auth!=null.

In addition, you can automatically sign users out after one hour on your client side, say using JavaScript timers and checking (await firebase.auth().currentUser.getIdToken()).auth_time as well. (Please note that this merely improves user experience on the client side and is not a substitute for the Security Rules, since client code cannot be fully trusted.)

user_162026370
Related