firebase / firebase/firebase-tools-ui

Firebase tools rejects any refreshed token after one week which deem it revoked

Open
#1,026 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
291
Forks
74
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Emulator always revokes tokens that are older than one week

**To Reproduce**
When using firebase emulator, after a week of authentication, token passes the expired token check but never pass the token revoked check

Facing this issue for few month now for a project i'm working on. Had to debug through the firebase tools as follows:
in node_modules/firebase-admin/lib/base-auth.js
in the verifyDecodedJWTNotRevokedOrDisabled function:

```
decodedIdToken = {
"name": "",
"picture": "",
"roles": [
"admin"
],
"email": "*****************",
"email_verified": false,
"auth_time": 1704074185, <<<<<<-------------------------------
"user_id": "hcHenhueMtmiDDa8MUXMg30jXIj0",
"firebase": {
"identities": {
"email": [
"****************"
]
},
"sign_in_provider": "password"
},
"iat": 1711809021,
"exp": 1711812621,
"aud": "************",
"iss": "https://securetoken.google.com/togonowreact",
"sub": "hcHenhueMtmiDDa8MUXMg30jXIj0",
"uid": "hcHenhueMtmiDDa8MUXMg30jXIj0"
}
```

Emulator will always throw token revoked error if the login is over a week even though the token has been refreshed

const authTimeUtc = decodedIdToken.auth_time * 1000;
// Get user tokens valid after time in milliseconds UTC.
const validSinceUtc = new Date(user.tokensValidAfterTime).getTime();
// Check if authentication time is older than valid since time.
if (authTimeUtc < validSinceUtc) {
throw new error_1.FirebaseAuthError(revocationErrorInfo);
}

node_modules/firebase-admin/lib/base-auth.js:
**Screenshots**
![image](https://github.com/firebase/firebase-tools-ui/assets/46498460/1b98bc86-eda9-4acf-bccc-c66ac5a35969)

As of now, the decodedidToekn resolved to the following PST time:

```
authTimeUtc: 1704074185000
which resolves to: Sunday, December 31, 2023 5:56:25 PM

validSinceUtc: new Date(user.tokensValidAfterTime).getTime()
1711179389000
which resolves to: Saturday, March 23, 2024 12:36:29 AM

```

Which always results true on the following if statement
```
if (authTimeUtc < validSinceUtc) {
throw new error_1.FirebaseAuthError(revocationErrorInfo);
}

```

Contributor guide

Open the contributing guide

Research direction

The report points to node_modules/firebase-admin/lib/base-auth.js and verifyDecodedJWTNotRevokedOrDisabled; start by tracing how the emulator creates refreshed tokens and supplies tokensValidAfterTime. Reproduce the post-week refresh case, compare auth_time with validSinceUtc, and identify the owning source or test. Done means a refreshed token no longer triggers the revoked-token path, with coverage for the reported case.

Written by the indexing model from the issue text.

Assessment

Tech stack
firebase, typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.