Firebase ID Token

Description

General

• Documentation: https://firebase.google.com/docs/auth/admin/verify-id-tokens
• Summary: Firebase Authentication is Google's managed sign-in service for mobile and web apps, part of Firebase and Google Cloud. A Firebase ID token proves a signed-in end user's identity to the app's backend and to Firebase services; the issuer names the Firebase project and the token grants whatever that user's account is allowed by the project's Firestore, Storage and Realtime Database security rules. ID tokens are short-lived, expiring one hour after issuance.

Revoke the secret

ID tokens cannot be revoked one by one and expire on their own after an hour. To cut off the underlying session, revoke the user's refresh tokens with the Admin SDK (revokeRefreshTokens) and then disable or delete the user in the Firebase console (Authentication > Users). Any ID token already issued stays usable until it expires.

Details for Firebase ID Token

• Family: token

• Category: cloud_provider

• Company: Google

• High recall: False

• Validity check available: False

• Analyzer available: False

• Revoker available: False

• Occurrences found for one million commits: 0.72

• Prefixed: False