firebase / firebase/firebase-js-sdk

FR: Firebase auth instance stored android device storage in unencrypted way

Open
#4,896 2 comments 0 reactions 1 assignee Claimed by @sam-gc View on GitHub
api: auth feature request
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### [REQUIRED] Describe your environment

* Operating System version: android (> 6)
* Firebase Product: firebase

### [REQUIRED] Describe the problem
on developing a react-native android application there I'm using firebase for authentication purposes. I could see the auth instance stored in Sqlite RkStorage in an unencrypted manner.

I felt it is an unsecured way and we facing some security alerts due to this on security check since auth instance having refresh token, access token, and other sensitive information of the user, this can cause hacking the user data when the android device is rooted.

My current case

![image](https://user-images.githubusercontent.com/24585569/117957666-ed418780-b337-11eb-8c83-8a771129e2c7.png)

Since I'm using the firebase library I don't know how to control it to make the auth instance encrypted while storing to device storage.

Kindly correct me if any point is wrong and suggest any better way to proceed further on it if it is possible.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.