firebase / firebase/firebase-js-sdk

FR: Expose refresh_token in login result for Google OAuth Provider

Open
#2,532 4 comments 4 reactions 0 assignees View on GitHub
api: auth feature request
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### [REQUIRED] Describe your environment

* Operating System version: MacOS 10.15
* Browser version:
* Firebase SDK version: 7.9.0
* Firebase Product: Auth

### [REQUIRED] Describe the problem

Unable to persist Authentication for 3rd Party Google services using auth.GoogleAuthProvider()

Using Firebase Auth, when the user signs in successfully (using the Google Auth Provider) the returned result object only has the short lived OAuth access_token. Based on what I have read everywhere on the internet Firebase immediately discards the accompanying OAuth refresh_token.

When trying to interact with 3rd party Google services from a NodeJS environment (read: googleapis) the access_token only works for one hour. After that, unless the signinwithprovider method is fired again (read: the user is forced to re-authenticate for no reason) there is no way to update the access token on the server without the refresh_token.

This could easily be overcome if the refresh token was exposed. Even if only returned on first login. This could then be stored securely (Using firebase ;)) and access tokens could be created as needed.

Currently all suggested workarounds require handling the sign in flow manually or using the client library which isn't ideal for obvious reasons.

Please let me know if there is something I am missing here, but after days of scouring it seems like retrieving 3rd party refresh tokens after successful a sign in is not currently possible.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.