Auth persistence sometimes clears the user

[hatboysam]

[REQUIRED] Describe your environment

• Operating System version: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:95.0) Gecko/20100101 Firefox/95.0
• Browser version: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:95.0) Gecko/20100101 Firefox/95.0
• Firebase SDK version: 9.6.1
• Firebase Product: auth

[REQUIRED] Describe the problem

Steps to reproduce:

Users have been reporting to me that they are being signed out of my website after a few days. This has only started happening since I updated my app from Firebase v8 to the v9 modular SDK. My app only uses Custom Authentication.

I initialize Auth as follows:

const authOptions = {
  persistence: [
    indexedDBLocalPersistence,
    browserLocalPersistence,
    browserSessionPersistence
  ]
};

const auth = initializeAuth(app, authOptions);

In my main app initialization code I attach a global Auth listener:

onAuthStateChanged(auth(), user => {
  console.log(`onAuthStateChanged(${user ? user.uid : null})`);
  if (!user) {
    // ...
  }
});

Sometimes I seem to get onAuthStateChanged called with a null user even after the user has been signed in for days. For my own app logic I also store my own user state in LocalStorage and this state persists infinitely, whereas Firebase seems to clear sometimes.

So I get errors from the following situation:

1. App loads
2. Synchronously check my own LocalStorage user store, find a non-null user
3. Allow the user to progress deeper into the app, assuming that they are signed in
4. Asynchronously receive an onAuthStateChanged callback from Firebase with user === null
5. Throw an error and punt the user back to the sign-in screen

[argzdev]

Hi @hatboysam, thanks for your report. We'll try to investigate this and see what we can find.

[sam-gc]

Hi @hatboysam, is there any network call before this happens (i.e. does the token try to get refreshed and the call fails? that's one reason the SDK might log the user out)? Have you noticed any particular pattern to the issue or is it random?

[hatboysam]

@sam-gc yes in one report there is a network request to this endpoint 30 seconds before the null event:

POST https://identitytoolkit.googleapis.com/v1/accounts:lookup?key=...

In another report I see this request, also exactly 30 seconds before the null event:

POST https://securetoken.googleapis.com/v1/token?key=...

So it seems like the Auth SDK is making some request, timing out after 30 seconds, and then signing out. However I don't believe this is a simple "user offline" issue for two reasons:

1. I can see other successful HTTP requests to Firebase in my logs in that 30-second window
2. Reports of this only began with my rollout of the v9 new Auth SDK (I did this upgrade about a month ago)

Here's a sample of the timeline:

So while other requests are succeeding, Auth requests are failing / timing out. So ... is there some other kind of logging I could add to help debug this? Maybe you have some backend logs you could look into to see if there are latency spikes in the Firebase Auth / GCIP backend lately?

[sam-gc]

The linked PR should fix the issue. Separately, it's odd that the request is timing out. Regardless this should still fix the issue and restore the expected v8 functionality

[hatboysam]

@sam-gc nice thank you!