I have a functionality in my app where the users can change their password or update their email address.

According to this document https://firebase.google.com/docs/auth/admin/manage-sessions i would assume that when the same user is logged in on another device at the same time that the refresh token should be revoced when the password changes and the user should be logged out. It seems that this does not happen in my case. I use these two listeners to detect the changes:

addStateDidChangeListener
addIDTokenDidChangeListener

They are normally working when I login/logout via the Firebase login and logout functions but they don't get called when I change the password on another device.

Is there any way to get notified when a user change the password on another device?

CodePudding user response：

Firebase Authentication uses ID tokens to maintain the authentication state on the client, and these tokens are valid for one hour. Only once the SDK needs to refresh the token (which it automatically does about 5 minutes before the token expires) is it guaranteed to detect the change, so that may take up to an hour.

If you want to force refreshing of the token before it expires, you can call reload on the User object.