firebase / firebase/firebase-tools-ui
Firebase tools rejects any refreshed token after one week which deem it revoked
- Dominant language
- TypeScript
- Stars
- 291
- Forks
- 74
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Emulator always revokes tokens that are older than one week
**To Reproduce**
When using firebase emulator, after a week of authentication, token passes the expired token check but never pass the token revoked check
Facing this issue for few month now for a project i'm working on. Had to debug through the firebase tools as follows:
in node_modules/firebase-admin/lib/base-auth.js
in the verifyDecodedJWTNotRevokedOrDisabled function:
```
decodedIdToken = {
"name": "",
"picture": "",
"roles": [
"admin"
],
"email": "*****************",
"email_verified": false,
"auth_time": 1704074185, <<<<<<-------------------------------
"user_id": "hcHenhueMtmiDDa8MUXMg30jXIj0",
"firebase": {
"identities": {
"email": [
"****************"
]
},
"sign_in_provider": "password"
},
"iat": 1711809021,
"exp": 1711812621,
"aud": "************",
"iss": "https://securetoken.google.com/togonowreact",
"sub": "hcHenhueMtmiDDa8MUXMg30jXIj0",
"uid": "hcHenhueMtmiDDa8MUXMg30jXIj0"
}
```
Emulator will always throw token revoked error if the login is over a week even though the token has been refreshed
const authTimeUtc = decodedIdToken.auth_time * 1000;
// Get user tokens valid after time in milliseconds UTC.
const validSinceUtc = new Date(user.tokensValidAfterTime).getTime();
// Check if authentication time is older than valid since time.
if (authTimeUtc < validSinceUtc) {
throw new error_1.FirebaseAuthError(revocationErrorInfo);
}
node_modules/firebase-admin/lib/base-auth.js:
**Screenshots**

As of now, the decodedidToekn resolved to the following PST time:
```
authTimeUtc: 1704074185000
which resolves to: Sunday, December 31, 2023 5:56:25 PM
validSinceUtc: new Date(user.tokensValidAfterTime).getTime()
1711179389000
which resolves to: Saturday, March 23, 2024 12:36:29 AM
```
Which always results true on the following if statement
```
if (authTimeUtc < validSinceUtc) {
throw new error_1.FirebaseAuthError(revocationErrorInfo);
}
```
Contributor guide
Research direction
The report points to node_modules/firebase-admin/lib/base-auth.js and verifyDecodedJWTNotRevokedOrDisabled; start by tracing how the emulator creates refreshed tokens and supplies tokensValidAfterTime. Reproduce the post-week refresh case, compare auth_time with validSinceUtc, and identify the owning source or test. Done means a refreshed token no longer triggers the revoked-token path, with coverage for the reported case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- firebase, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100