如何通过管理SDK登出用户？ （使auth === null）

Question

When the user ID token is revoked the information should be passed to client for actions like reauthentication or user signOut().

On the client we can call FirebaseAuth.DefaultInstance.SignOut . How can we achieve the same effect with admin SDK?

Is there a way to sign out the user via admin SDK? (make the auth === null).

A 'hacker' could alter the client code and prevent the app from sign out or reauthentication. I know I can check if the token was revoked with admin SDK and firebase rules but it would be much easier to check only if the auth is null. Or is my thinking wrong as the 'hacker' got the ID token once and can send requests with these credentials anyway even after the client app called FirebaseAuth.DefaultInstance.SignOut?

Answer 1

Is there a way to sign out the user via admin SDK?

The Admin SDK provides a way to revoke a user's refresh token. This does not immediately sign the user out, since the user has an non-revokable ID token which is valid for an hour.

If you want to immediately make backend-resources unavailable to the client whose token you revoked, you can write their state to the database when you revoke the token, and then access that from your security rules. There is no simpler way to block them instantly. Also see Five tips to secure your app , which covers this and security topics.

A 'hacker' could alter the client code and prevent the app from sign out or reauthentication

The client's authentication state is based on an ID token that is valid for an hour after it's been minted. The client cannot extend the token beyond that. To get a new ID token it will have to call to the authentication server, which will fail after its refresh token has been revoked.

Signing the user out on a client makes that client forget the tokens for that user. The ID token would still be valid, but nobody will know about it. Keep in mind: all traffic between the app and the servers is sent over (end-to-end encrypted) HTTPS connections. This means a man-in-the-middle attack is only possible if somebody is able to decrypt this traffic, which requires that they have access to the certificate. See for a better explanation Does https prevent man in the middle attacks by proxy server? .