firebase / firebase/firebase-android-sdk

Firestore is not picking up fresh auth token and reinitialising event listeners when the current token is stale.

Open
#5,101 58 comments 2 reactions 2 assignees Claimed by @rlazo View on GitHub
api: app-check api: firestore
Dominant language
Java
Stars
2.6k
Forks
710
Avg merge
2d 23h
Merged PRs (30d)
34

Description

### [READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in __the code in this repository__.
If you have a general question, need help debugging, or fall into some
other category use one of these other channels:

* For general technical questions, post a question on [StackOverflow](http://stackoverflow.com/)
with the firebase tag.
* For general Firebase discussion, use the [firebase-talk](https://groups.google.com/forum/#!forum/firebase-talk)
google group.
* For help troubleshooting your application that does not fall under one
of the above categories, reach out to the personalized
[Firebase support channel](https://firebase.google.com/support/).

### [REQUIRED] Step 2: Describe your environment

* Android Studio version: Android Studio Flamingo | 2022.2.1 Patch 2
* Firebase Component: _____ Firestore, Auth
* Component version: Android BOM 32.0.0

### [REQUIRED] Step 3: Describe the problem

We have this issue on the FlutterFire repository: https://github.com/firebase/flutterfire/issues/11146
There's also an active SO issue here: https://stackoverflow.com/questions/76436462/firebase-logged-in-user-with-expired-auth-id-token?noredirect=1

To summarise:

1. The user logs in via Auth SDK. Firestore snapshot event listeners are attached.
2. The app goes into the background for a lengthy period of time (in the range of 5-10 hours).
3. Whilst the user is still logged in, the event listeners start firing exceptions with "permission-denied" exceptions.
4. Requires manually reattaching the Firestore snapshot listeners to make use of the fresh auth token.

My understanding and after discussion with @puf, Firestore ought to pick up the fresh auth token under the hood, and reattach the snapshot event listeners without the user having to do this step manually.

#### Steps to reproduce:

Not an easy one to reproduce as it requires a lengthy time period, but following on from the summary:

1. Implement Firestore event listener that requires level of auth access via Firestore rules.
2. Log user in via Auth with access to the data being listened to.
3. Put app in background for >= 10 hours (Might be worth just letting it run for the day and coming back to it.)
4. Bring app to foreground, add data to that aspect of data being listened to on snapshot listener, and wait for a `permission-denied` error via logcat.

The user mentioned in the FlutterFire issue that the problem occurs when the app is brought to the foreground but I have asked for confirmation whether it occurs when the app is also in a background state as I suspect it does. This would remove the variable of app state from the reproduction.

#### Relevant Code:

Create a barebones app on android studio and implement simple Auth login with Firestore event listener following steps mentioned above.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.