firebase / firebase-admin-node

Firebase Admin Node.js SDK
https://firebase.google.com/docs/admin/setup
Apache License 2.0
1.61k stars 363 forks source link

Session cookie refresh #2349

Open francescovenica opened 10 months ago

francescovenica commented 10 months ago

Hello I'm using Firebase Auth (actually gcp identity platform) with the session cookie in a NextJS app, everything is working fine but I'm looking a way to refresh the cookie to avoid forcing the user to login again when the session expire. There isn't an official way to do that but I might have found a solution, I'm just not 100% sure this is secure enough or if there are issues I'm missing, the idea is to have a refresh endpoint with this code:

    const idToken = req.cookies.session || req.body.sessionCookie;
    const session = await auth().verifySessionCookie(idToken, true);

    if (session) {
      const customToken = await auth().createCustomToken(session.uid);

      const response = await fetch(
        `${GOOGLE_API}:signInWithCustomToken?key=${process.env.NEXT_PUBLIC_API_KEY}`,
        {
          method: "POST",
          cache: "no-cache",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({ token: customToken, returnSecureToken: true }),
        },
      );

      const result = await response.json();
      const sessionCookie = await auth().createSessionCookie(result.idToken, {
        expiresIn,
      });

      setCookie(res, "session", sessionCookie, {
        ...cookieOptions,
        maxAge: expiresIn,
      });

      return res.json({ session, customToken, sessionCookie });
    }

then every time I want I can call this refresh endpoint and the session will be updated...it seems to work but I'd like to have some feedback on this.

google-oss-bot commented 10 months ago

I found a few problems with this issue:

gustavopch commented 9 months ago

Also curious about this. I hope someone from the team can leave comment.

brad-technologik commented 6 months ago

Also looking for this. I can't find a way to force a id token / cookie update when I have changed claims on the user (eg they change their name, so I want to update the cookie with it).

jordanebelanger commented 5 months ago

This is badly needed.

I cannot just force my users to re-login every 2 weeks regardless of their activity on our systems, this is an unacceptable sub standard quality pattern. This is exacerbated if you have requirements for shorter session duration.

Right now, (exactly like @francescovenica ) to circumvent this, we have a custom solution that refresh session cookies through a custom token authentication for that user once his cookie is close to expiring, but even then, the firebase-admin lib does not have the sign in with custom token endpoint exposed directly, so we have to do an API call manually for this after creating a custom token.