firebase / firebase/firebase-js-sdk
FR: Expose refresh_token in login result for Google OAuth Provider
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### [REQUIRED] Describe your environment
* Operating System version: MacOS 10.15
* Browser version:
* Firebase SDK version: 7.9.0
* Firebase Product: Auth
### [REQUIRED] Describe the problem
Unable to persist Authentication for 3rd Party Google services using auth.GoogleAuthProvider()
Using Firebase Auth, when the user signs in successfully (using the Google Auth Provider) the returned result object only has the short lived OAuth access_token. Based on what I have read everywhere on the internet Firebase immediately discards the accompanying OAuth refresh_token.
When trying to interact with 3rd party Google services from a NodeJS environment (read: googleapis) the access_token only works for one hour. After that, unless the signinwithprovider method is fired again (read: the user is forced to re-authenticate for no reason) there is no way to update the access token on the server without the refresh_token.
This could easily be overcome if the refresh token was exposed. Even if only returned on first login. This could then be stored securely (Using firebase ;)) and access tokens could be created as needed.
Currently all suggested workarounds require handling the sign in flow manually or using the client library which isn't ideal for obvious reasons.
Please let me know if there is something I am missing here, but after days of scouring it seems like retrieving 3rd party refresh tokens after successful a sign in is not currently possible.
Contributor guide
Assessment
This issue has not been assessed yet.