Firebase ID token has expired.

[IgorRosocha]

[REQUIRED] Step 1: Describe your environment

• Xcode version: 11.7
• Firebase SDK version: 6.31.0
• Firebase Component: Auth
• Component version: 6.31.0
• Installation method: Carthage

[REQUIRED] Step 2: Describe the problem

Steps to reproduce:

In our app, we use Firebase authentication token to identify user on our backend. We are sending this token with every request. We retrieve Firebase token using getIDToken(completion:) with every request.

The documentation says the method Retrieves the Firebase authentication token, possibly refreshing it if it has expired., but from time to time, we receive error Firebase ID token has expired. Get a fresh ID token from your client app and try again (auth/id-token-expired). See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token. This is kind of a major issue for our app, as we automatically log out users which receive unauthenticated error (because of user deletion functionality) - not mentioning that all of the requests automatically fail because of expired token.

Am I misunderstanding the concept of retrieving the token using getIDToken(completion:), or is this the bug in SDK?

[sam-gc]

Hi, thanks for reaching out--

Where are you seeing the auth/id-token-expired error? In your backend code or on the client?

How much time elapses between calling getIdToken and your backend doing the verification? Is it possible the token is becoming expired in flight (meaning: order of minutes between getting it from the client and doing verification on the backend)

[IgorRosocha]

Where are you seeing the auth/id-token-expired error? In your backend code or on the client?

In the response from backend.

How much time elapses between calling getIdToken and your backend doing the verification? Is it possible the token is becoming expired in flight (meaning: order of minutes between getting it from the client and doing verification on the backend)

I believe not. This happens after user launches the app, and sends initial requests with token to BE. Token is retrieved on the client using getIDToken(completion:) with every request.

[sam-gc]

Hmm yeah this is interesting. The relevant bit of code is here: https://github.com/firebase/firebase-ios-sdk/blob/master/FirebaseAuth/Sources/SystemService/FIRSecureTokenService.m#L110

The token should be valid for at least 5 minutes whenever you call this. Is there any more detail in the error you get back from the server? (A code or anything of that sort?)

[IgorRosocha]

Is there any more detail in the error you get back from the server? (A code or anything of that sort?)

Not really. We use gRPC, and the response received from BE looks like this:

failure(unauthenticated (16): Firebase ID token has expired. Get a fresh ID token from your client app and try again (auth/id-token-expired). See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.)

Metadata received from BE contain this mesage:

Firebase ID token has expired. Get a fresh ID token from your client app and try again (auth/id-token-expired).

[olejnjak]

Would it be possible that if multiple calls to getIDToken(completion:) are made, we would receive one valid token for the first time, which will be invalidated with subsequent calls?

EDIT: But as I look into how FIRSecureTokenService works, it seem to be unlikely.

[sam-gc]

Chatted with the team a bit-- one thing to consider is that the SDK will automatically refresh the token if it has expired or if it will expire in the next 5 minutes. If the device has its clock running a bit behind then it will think the token has not expired even though it may have. Then, when you send it to your backend, your backend has the correct time and sees the token as expired.

The reverse may be true as well: if for some reason your server's clock is a bit ahead, it may incorrectly think the token is expired.

One thing to try: you can manually parse the ID token and log failures. Here's a snippet in Javascript but you can apply this equally in any language:

// Where atob is Base64 decode
const expirationTimeInSecondsSinceEpoch =
    JSON.parse(atob(token.split('.')[1])).exp

That will get you the expiration time of the token in question. I'd suggest adding some sort of logging to your backend that records the token's expiration time and the server's current time when you catch this particular error.

(And I have to post this just in case, please don't post the ID token or other information here 😄 )

[google-oss-bot]

Hey @IgorRosocha. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!