Cfrgtkky

according to the Google Support, the only way to detect revoked firebase tokens is by making a read-request to my Firestore and catching back the FIRAuthErrorCodeUserTokenExpired error.

I tried it in didFinishLaunchingWithOptions() of my iOS App. The data is read correctly, but there should be an error as I deactivated the test-user account (token should be revoked). Unfortunately, Firebase still handles the request and logs in the user without throwing an error.

For an app that should be as secure as possible, it is very suboptimal if you stay logged in into the app though you're token has already been revoked.

Here is my code:

func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {

    // Override point for customization after application launch.

    FirebaseApp.configure()

    window = UIWindow()

    if Auth.auth().currentUser == nil { // check if there is a User logged in

        window?.rootViewController = LoginViewController() // set the MainTabBarController as the root (start) controller

    } else{

        if let uid = Auth.auth().currentUser?.uid{

            let firRef = Firestore.firestore().collection("idols").document(uid)

            firRef.getDocument { (document, error) in

                if let err = error {

                    print(err)

                    self.window?.rootViewController = LoginViewController()

                }else{

                    guard let doc = document, let data = doc.data() else {return}

                    guard let username = data["username"] as? String, let uid = data["uid"] as? String, let biography = data["biography"] as? String else {return}

                    self.activeUser = User(uid: String(uid), username: username, biography: biography)

                    print(self.activeUser)

                    self.window?.rootViewController = MainTabBarController()

                }

            }

        }

        window?.rootViewController = LoginViewController()

    }





    return true

}

Here my Firebase Rules:

service cloud.firestore {

  match /databases/{database}/documents {

    match /{document=**} {

      allow read, write: if request.auth.uid != null;

    }

  }

}

I am aware that the rules are not perfectly adjusted yet but in my eyes, Firebase should throw an error, as the token is expired. I am aware that I have not yet checked for the correct error but the if let does not get called anyways.

I checked multiple resources including the Firebase documentation corresponding to this topic but the documentation only covers how to detect revoked tokens in the web and not on iOS or Android.

Besides that, I checked a stack overflow entry but it had no correct answer that was helpful so I decided to post my own one here:

Does anyone know the right way how to detect revoked tokens as soon as they occur on iOS?

I am sorry if this question is not perfectly formulated. I am still new to stack overflow, so please be kind :)

I found the following solution:

in didFinishLaunchingWithOptions add the following piece of code:

if Auth.auth?.currentUser == nil {

   // You need to prompt the user login interface

} else {

  Auth.auth().currentUser?.reload(completion: { (error) in

    if error != nil {

        if let err = error as NSError?{

            if let error = AuthErrorCode(rawValue: err.code){

                switch error{

                // You need to prompt the user login interface

                case .invalidCredential: print("Invalid credentials")

                case .invalidUserToken: print("Invalid User Token")

                case .userTokenExpired: print("User Token Expired")

                case .invalidCustomToken: print("Invalid Custom Token")

                case .customTokenMismatch: print("Custom token mismatch")

                case .userDisabled: print("User disabled")

                case .userNotFound: print("User not found")

                default: print("call default error")

                }

            }

        }

    }

    else {

        print("Valid Token")

    }

  })

}

Ah, and don't forget to initialize Firebase before running this code (else you won't have access to Firebase Auth)