Firebase authentication duration is too persistent

10
votes

Bit of context, I am trying to use Firebase for both authentication and data storage. Since my application deals with potentially sensitive data, the confidentiality features offered by Firebase (all Firebase communication is done via HTTPS according to their blog) seems like a great way to keep my data secured. In fact, the only problem I have with Firebase is that authentication last far longer than it should. As far as I can tell, it lasts through device resets, application rebuilds and loss of connection. Even worse, I have no idea how long it persists for. I've tried searching online but I can't find the information anywhere. As far as I can tell, it lasts around a day, but that's just a guess. I am using email and password as credentials for my sign in.

My question has two parts, does anyone know the default duration of Firebase authentication and does anyone know how to shorten it? Otherwise are there any other services that are similar to Firebase where you can set the authentication duration?

If I could shorten the duration to 4 hours Firebase would literally be perfect, other wise I might have to implement my own authentication, since authentication that last's for as long as Firebase is far too insecure.

1
firebasefirebase-authentication
I guess an idea would be to grab the token firebase generates and set a timeout on it. - U r s u s
Can you implement a simple flag set by .onDisconnect? i.e. when the user logs in, set a firebase flag; goodConnect = true. Then when the connection is interrupted by one of the issues you mentioned, have the onDisconnect set the goodConnect = false. When the user reconnects, if that flag is false, unAuth them and send them back to the initial login screen? onDisconnect runs on the server so it's autonomous of your app. - Jay
I'm not worried about losing the connection with Firebase, I've implemented some security myself to handle that (the app needs some functionality to work offline anyways). What I'm worried about is someone gaining access to the physical device (its a phone, I can't even be sure it will have a PIN) and have uncontested access to anything that user has access to. The timeout idea has promise could definitely work, I didn't realize you could do that, its definitely not in any of the firebase documentation I've seen. - Alex

1 Answers

17
votes

Firebase Authentication (for 3.x or higher SDKs) uses two types of tokens:

  1. A token that identifies the user. This token is created when the users signs in with the app and does not expire. To get rid of this token, sign out the user.

  2. A token that allows the user to access the Firebase back-end. This token is based on the previous token, is valid for an hour, and is automatically created and refreshed by the Firebase SDKs.