I have a flutter app with a node.js backend api. I'm using firebase Auth for authentication. The way it works now (which I don't know is standard,) is the user sends a request to firebase auth to login/signup. The jwt gets stored in the flutter app, then it sends that firebase jwt to my API, which verifies it's a valid token firebase.auth().verifyIdToken(), and my API sends over a new jwt created with firebase firebase.auth().createCustomToken(...) with custom info.

Before every response my API sends over, it checks if the custom jwt was created after 15 min. If it was, it recreates a new custom jwt. If it passed 7 days since it's original creation, it logs out the user.

The problem is, I don't see a way to regenerate a firebase auth token on the server. Which means every hour the user will have to re-login.

I feel I'm overcomplicating things, but I'm not sure of a better design of doing this. Is there a standard? How can I make this better and how can I make it that the user doesn't have to re-login after just 60 min?

CodePudding user response：

The custom tokens created by createCustomToken() are used when you have a third party auth system but you want to login your users with Firebase auth.

The problem is, I don't see a way to regenerate a firebase auth token on the server. Which means every hour the user will have to re-login.

You don't have to do anything on the server. Every time you need to call your API, you can use getIdToken() to get user's ID token.

var token = await FirebaseAuth.instance.currentUser().getIdToken();

This will return user's current token and if it has expired then it'll a refreshed token. You can then pass the result to your API. There's no need to explicitly store the token anywhere yourself.

Whenever you are making an API request, the flow could be as simple as:

1. Get user's ID Token using getIdToken()
2. Pass this token in your API request
3. Verify it using verifyIdToken() and return the response.