Session cookie refresh

Hello I'm using Firebase Auth (actually gcp identity platform) with the session cookie in a NextJS app, everything is working fine but I'm looking a way to refresh the cookie to avoid forcing the user to login again when the session expire. There isn't an official way to do that but I might have found a solution, I'm just not 100% sure this is secure enough or if there are issues I'm missing, the idea is to have a refresh endpoint with this code:

```
const idToken = req.cookies.session || req.body.sessionCookie;
const session = await auth().verifySessionCookie(idToken, true);

if (session) {
const customToken = await auth().createCustomToken(session.uid);

const response = await fetch(
`${GOOGLE_API}:signInWithCustomToken?key=${process.env.NEXT_PUBLIC_API_KEY}`,
{
method: "POST",
cache: "no-cache",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ token: customToken, returnSecureToken: true }),
},
);

const result = await response.json();
const sessionCookie = await auth().createSessionCookie(result.idToken, {
expiresIn,
});

setCookie(res, "session", sessionCookie, {
...cookieOptions,
maxAge: expiresIn,
});

return res.json({ session, customToken, sessionCookie });
}
```

then every time I want I can call this refresh endpoint and the session will be updated...it seems to work but I'd like to have some feedback on this.

El único punto de entrada descrito es el endpoint de refresh propuesto, que lee una cookie de sesión o un valor del cuerpo de la solicitud y crea una nueva cookie de sesión. Revisa primero el flujo de cookies de sesión de Firebase Auth y las implicaciones de seguridad del endpoint; el issue solo está terminado cuando se hayan establecido un enfoque de refresh compatible y claramente seguro, y su comportamiento esperado.

Escrito por el modelo de indexación a partir del texto del issue.