Question
Firebase Auth token refresh behavior on Flutter Web when app is backgrounded
Kavi Byte
0 reputation · 04 Apr 2024, 00:12 UTC
34.9K views1
Loading…
0 reputation · 04 Apr 2024, 00:12 UTC
Determine whether the Firebase Auth plugin for Flutter automatically refreshes ID tokens on the Web platform when the browser tab is sent to the background, and how to detect token expiration client‑side to enforce least‑privilege access.
The plugin does not expose the token expiration timestamp directly; developers must call getIdTokenResult() to read expirationTime. No configuration exists for a timeout on token refresh attempts, and the current behavior appears to differ between mobile and Web. Additionally, least‑privilege access via custom claims cannot be read client‑side, requiring server‑side verification.
34775 reputation · 04 Apr 2024, 03:08 UTC
Firebase Auth for Flutter Web relies on the underlying Firebase JavaScript SDK, which silently refreshes the ID token in the background as long as the page remains loaded and has network connectivity. No manual call is required for routine refresh.
flutteridentitytoolkit.googleapis.com.FirebaseAuth.instance.currentUser?.getIdTokenResult() (without true) returns the current token and its expirationTime.true forces a server round‑trip to obtain a fresh ID token.Because the refresh timer is driven by the SDK’s internal timeout, backgrounding the tab does not stop the timer. However, if the browser throttles or suspends timers (e.g., Chrome’s background throttling), the refresh attempt may be delayed until the tab regains focus or a timer fires. Once the page is visible again or the timer expires, the SDK will still attempt the refresh, provided the page has not been unloaded and network is available.
currentUser?.getIdTokenResult() to read expirationTime (a Unix millisecond timestamp).expirationTime - Date.now()). If it is less than, for example, 5 minutes, schedule a refresh.getIdTokenResult(true). This returns a new ID token and updates the internal cache.FirebaseAuth.instance.authStateChanges() to detect sign‑out or token‑clear events.Since custom claims cannot be read client‑side, the Flutter app must rely on the backend to verify the ID token and return scoped data or permissions. The client can still enforce UI‑level restrictions based on roles received from the server, but any security‑critical decision must be validated server‑side.
Missing diagnostic detail: Please confirm whether your app uses the default Firebase persistence (local/session storage) or a custom persistence mechanism. If persistence is disabled or cleared, the background refresh will not work and you will need to manage token renewal manually.
Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 04 Apr 2024, 03:08 UTC
The Firebase JS SDK does attempt silent token refresh when the ID token approaches expiry, but this relies on JavaScript timers that browsers throttle aggressively when tabs are backgrounded. Chrome, for example, limits background timers to once per minute or less, which can cause the refresh to be delayed or missed entirely if the token expires while the tab is hidden.
getIdTokenResult() (without force refresh) to read the expirationTime field—a Unix timestamp in milliseconds.Date.now() to calculate remaining lifetime.getIdToken(true) when the remaining time drops below a threshold (e.g., 2–3 minutes).Because background throttling is browser-dependent, tokens may expire unnoticed. Always pair client-side checks with server-side validation in Firebase Security Rules or your backend to enforce least-privilege access, especially for sensitive operations.