Open francescovenica opened 10 months ago
I found a few problems with this issue:
Also curious about this. I hope someone from the team can leave comment.
Also looking for this. I can't find a way to force a id token / cookie update when I have changed claims on the user (eg they change their name, so I want to update the cookie with it).
This is badly needed.
I cannot just force my users to re-login every 2 weeks regardless of their activity on our systems, this is an unacceptable sub standard quality pattern. This is exacerbated if you have requirements for shorter session duration.
Right now, (exactly like @francescovenica ) to circumvent this, we have a custom solution that refresh session cookies through a custom token authentication for that user once his cookie is close to expiring, but even then, the firebase-admin lib does not have the sign in with custom token endpoint exposed directly, so we have to do an API call manually for this after creating a custom token.
Hello I'm using Firebase Auth (actually gcp identity platform) with the session cookie in a NextJS app, everything is working fine but I'm looking a way to refresh the cookie to avoid forcing the user to login again when the session expire. There isn't an official way to do that but I might have found a solution, I'm just not 100% sure this is secure enough or if there are issues I'm missing, the idea is to have a refresh endpoint with this code:
then every time I want I can call this refresh endpoint and the session will be updated...it seems to work but I'd like to have some feedback on this.