Firebase auth propagation time for Firestore rules?

Question

Am calling these functions in sequence (javascript 'firebase`):

firebase
  .auth()
  .signInWithEmailLink(email, url)
  .then(userCred => {
     return firebase.firestore().collection('users').doc('someDocID').get()
     ....

I have security rules setup in firestore that allows read of 'users/:docId' only if the email field in that document equals the auth email: allow get: if request.auth.token.email == resource.data.email

The problem is we get a missing or insufficient permissions error on the get(). For sure the email in the database is correct so the only problem could be is that request.auth.token.email is not valid. Could it be that signing in (using any sign in function), even if resolves, doesn't guarantee the auth token is updated and can be immediately used ?

Is there propagation time? should we call getIdToken() after sign in resolves to make sure the token is valid before making database/firestore calls?

Calling signInWithEmailLink will get an ID token with the latest values, which is then cached for about an hour. Are you saying that you actively sign in by calling signInWithEmailLink and see outdated properties? Can you log those in your code and show the updated code and its output? — Frank van Puffelen
Hi @FrankvanPuffelen, I can only see that randomly (not always) the FS get() called right after sign in resolves fails with a permissions problem. My understanding of your comment - after sign in resolves there should be no issue with the token sent to FS rules so its safe to use it that way - and thats what I'm trying to verify. — Shai Ben-Tovim
To verify you'll want to log the values from the user profile right before you make the problematic Firestore call. — Frank van Puffelen
Problem is this happens in customer use - not in our testing and we are not able to reproduce it in controlled env. — Shai Ben-Tovim

Frank van Puffelen Frank van Puffelen · Accepted Answer · 2020-09-30T15:05:20

When a user actively signs in (by calling any of the signInWith... methods), the client gets an ID token, which contains the up-to-date values for that user. That ID token is valid for an hour, and is then auto-refreshed by the client/SDK.

So right after the signIn... call, the profile should contain the latest values. If you think something is going wrong there, I'd recommend logging the values right before making the call to Firestore.

Firebase auth propagation time for Firestore rules?

1 Answers