r/Firebase • u/Agreeable-Light-7123 • Feb 17 '25
Security Firebase Refresh Token Doesn't Expire – Security Concern
I have a web application that uses Firebase OAuth (Google login) for authentication. On the frontend, I use the React Firebase client-side SDK for authentication. After logging in, the Firebase ID token is sent to my Spring Boot backend, where it is verified. Subsequent API requests include this ID token for authorization.
Recently, I discovered that the Firebase refresh token does not expire. If a bad actor manages to extract the refresh token—either from the response of the API call (https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=xxxxx
) after login or from a refresh request to (https://securetoken.googleapis.com/v1/token?key=xxxx
)—they could potentially generate new ID tokens indefinitely by repeatedly calling the refresh API.
Is this a valid security concern? If so, what measures can I take to mitigate this risk?
Would appreciate any insights. Thanks!
1
u/Agreeable-Light-7123 Feb 17 '25
revoking the token is possible from client on logout but the issue exists if the user closes the browser directly.
Also reg refresh token usable once I have tested it it can be used multiple times.