firebase / firebase/firebase-js-sdk

Auth SDK should attempt to detect clock skew

Open
#6,032 5 comments 1 reaction 0 assignees View on GitHub
api: auth feature request v9
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### [REQUIRED] Describe your environment

* Operating System version: all
* Browser version: all
* Firebase SDK version: 9.x
* Firebase Product: auth

### [REQUIRED] Describe the problem

#### Steps to reproduce:

If a user has a computer with an incorrect clock then it's possible for `getIdToken()` to return an expired token as the token will appear to be valid locally but when sent to a server and processed with the Admin `verifyIdToken()` function it will be expired.

The Firebase Auth SDK could detect clock skew and alert the developer in two main ways:

- If a token appears to have **more** than 1 hour of validity then there's clearly something wrong.
- The client can inspect the `date` header from the API request that gets the token and make sure the client and server agree on the date.

This is a somewhat rare situation but it's happening on our site and probably happening to others as well.

#### Relevant Code:

```javascript
firebase.auth().currentUser.getIdToken(false);
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.