Skip to content

Instantly share code, notes, and snippets.

@jwngr
jwngr / rules.js
Last active November 26, 2018 20:21
Implementing Firebase Auth Session Durations - Firestore Rules #3
function isSessionValid() {
return (request.auth.token.auth_time + (60 * 60 * 24 * 30)) * 1000 > request.time.toMillis();
}
allow read: if isSessionValid();
@jwngr
jwngr / rules.json
Created November 26, 2018 20:20
Implementing Firebase Auth Session Durations - Firestore Rules #2
allow read: if (request.auth.token.auth_time + (60 * 60 * 24 * 30)) * 1000 > request.time.toMillis();
@jwngr
jwngr / rules.json
Created November 26, 2018 20:19
Implementing Firebase Auth Session Durations - Firestore Rules #1
allow read: if request.auth.token.expiresAt > request.time.toMillis();
@jwngr
jwngr / rules.json
Created November 26, 2018 20:18
Implementing Firebase Auth Session Durations - RTDB Rules #2
".read": "(auth.token.auth_time + (60 * 60 * 24 * 30)) * 1000 > now"
@jwngr
jwngr / rules.json
Created November 26, 2018 20:18
Implementing Firebase Auth Session Durations - RTDB Rules #1
".read": "auth.token.expiresAt > now"
@jwngr
jwngr / server.js
Created November 26, 2018 20:16
Implementing Firebase Auth Session Durations - Server
admin.auth().createCustomToken(uid, {
// Add a custom claim indicating an expiration time of 30 days.
expiresAt: Date.now() + (1000 * 60 * 60 * 24 * 30),
})
.then((customToken) => {
// Send token back to client for authentication...
})
.catch((error) => {
console.log("Failed to create custom token:", error);
});
@jwngr
jwngr / client.js
Last active February 25, 2022 22:11
Implementing Firebase Auth Session Durations - Client
const auth = admin.auth();
auth.onAuthStateChanged((user) => {
let sessionTimeout = null;
if (user === null) {
// User is logged out.
// Clear the session timeout.
sessionTimeout && clearTimeout(sessionTimeout);
sessionTimeout = null;
} else {
// User is logged in.
@jwngr
jwngr / firebase-auth-tokens.tsv
Last active June 27, 2022 18:19
Firebase Auth Tokens
Token Type Lifetime Usage Generated By Format
Custom Token 1 hour Authenticate Firebase client SDKs You, via Firebase Admin SDK JWT
ID Token 1 hour Authenticate to Firebase services; validate server requests Firebase JWT
Refresh Token Long-lived (~1 year) Generate fresh ID tokens Firebase OAuth 2.0 refresh token
OAuth Access Token Varies by provider Authenticate to third-party identity provider APIs Third-party identity providers Varies by provider