Explicit renewal of session tokens in Firebase JS SDK

问题

I have implemented the signin method using Firebase Auth for several providers like that:

firebase.auth().setPersistence(firebase.auth.Auth.Persistence.LOCAL).then(() => {
  let provider = new firebase.auth.GoogleAuthProvider(); // + facebook, gitHub
  provider.addScope('profile');
  provider.addScope('email');
  firebase.auth().signInWithPopup(provider).then(result => {
    // app logic here

However this code gives me 60 min lasting sessions and I want to learn how to automatically renew the current user session without being forced to login every hour.

I'm also 'listening' to the current user session state using this code.

firebase.auth().onAuthStateChanged(user => if (!user) //goto LoginPage

But it doesn't 'listen' per se, it works only when I try to navigate or update the page. So I don't know how to restrict access by the exact amount of time (e.g. 15 minutes max) using Firebase methods.

The documentation says there is a getIdToken method but I can't wrap my head around where to use this code. Should it be invoked every 60 minutes just before the expiration or it should be set at the time of login? Please give some hints or any tutorials covering this very situation.

EDIT:

Also I get this code in the console after some period of inactivity (I think less than 1 hour):

auth.esm.js:121 POST https://securetoken.googleapis.com/v1/token?key=AIza... 403

回答1:

Firebase tokens are set to expire after 60 min. Then it gets refreshed for you automatically. There is no way to configure the expiration time, and you don't need to do anything special in your front-end code for that.

The only trick is that, you need to grant your application API key the permission to use the Token Service API to be able to mint a new id token for you once it's expired. This is done in the GCP console, API & Services (Credentials).

So, the code should be simple as the following

Add the user authentication state change Listener


fbAuth.onAuthStateChanged(user => {
  if (user) {
    // User is logged in
    // Proceed with your logged in user logic
  } else {
    // USer is not logged in
    // Redirect to the login page
  }
})

Implement the login logic


fbAuth.setPersistence(firebase.auth.Auth.Persistence.LOCAL)
 .then(() => {
    return fbAuth.signInWithEmailAndPassword(email, password)
        .then(userCredential => {
            // Login success path
        })
        .catch(error => {
            // Login error path
        });
 })
 .catch(error => {
    // Persistence setting error path
 })

You can set the Authentication State Persistence before the login, depending on your use cases auth-state-persistence.

Make sure that your application API key has access to the Token Service API in the GCP console This is under GCP Console | APIs & Services | Credentials Then edit the corresponding key to your deployment environment to grant the API key the access to the Token Service API.

Good luck ;)

回答2:

Hello first I am gonna say sorry fro my bad english. I dont really understand firebase but i think it should work if you write something like this:

firebase.auth().setPersistence(firebase.auth.Auth.Persistence.SESSION).then(() => {
let provider = new firebase.auth.GoogleAuthProvider(); // + facebook, gitHub
provider.addScope('profile');
provider.addScope('email');
firebase.auth().signInWithPopup(provider).then(result => {
// app logic here

I meant that you should have firebase.auth.Auth.Persistence.SESSION insted of LOCAL

来源：https://stackoverflow.com/questions/53901950/explicit-renewal-of-session-tokens-in-firebase-js-sdk

标签

javascript

reactjs

firebase

firebase-authentication