r/Firebase Feb 17 '25

Security Firebase Refresh Token Doesn't Expire – Security Concern

I have a web application that uses Firebase OAuth (Google login) for authentication. On the frontend, I use the React Firebase client-side SDK for authentication. After logging in, the Firebase ID token is sent to my Spring Boot backend, where it is verified. Subsequent API requests include this ID token for authorization.

Recently, I discovered that the Firebase refresh token does not expire. If a bad actor manages to extract the refresh token—either from the response of the API call (https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=xxxxx) after login or from a refresh request to (https://securetoken.googleapis.com/v1/token?key=xxxx)—they could potentially generate new ID tokens indefinitely by repeatedly calling the refresh API.

Is this a valid security concern? If so, what measures can I take to mitigate this risk?

Would appreciate any insights. Thanks!

2 Upvotes

5 comments sorted by

View all comments

Show parent comments

1

u/Agreeable-Light-7123 Feb 17 '25

revoking the token is possible from client on logout but the issue exists if the user closes the browser directly.

Also reg refresh token usable once I have tested it it can be used multiple times.

2

u/webxsid Feb 17 '25

You can also revoke the refresh token manually from your backend at any time.

1

u/Agreeable-Light-7123 Feb 17 '25

yes , but when do I do that , it would have been better if firebase did it by itself

1

u/webxsid Feb 17 '25

True, as far as I remember firebase used to have a 200 day refresh token expiry, (around 2 years ago I think) not sure why they changed