In the latest release of Firebase Authentication, login sessions don't expire anymore. Instead it uses a combination of long-lived account tokens and short-lived, auto-refreshed access tokens to get the best of both worlds.
If you want to end a user's session, you can call signOut().