fb-token-bug-v9

This repository's purpose is to provide a minimal reproduction pwa that demonstrates a firebase id token bug as noted here. To trigger the bug, deploy the app, sign in, wait an hour, place the app offline, and reload the page. Reloading the app offline prior to one hour will keep you signed in. After the hour passes, the user will be force signed out due to an error being thrown in getIdTokenResult().

Project setup

yarn install

Create a firebase project and user

1. Create a firebase project for web use.
2. Set up the email/password sign-in method
3. Add a user
4. Assign some custom claims to the user. You can use the set_program_env_claims script for this purpose, if desired. You will need your firebase service account private key with the script. Two custom claims named 'program' and 'env' will be added to your user's id token.

node set_program_env_claims <project-id> <email-address> <program-id> <env>

env.local file

The firebase project configuration secrets are stored in a file named env.local. Create this file at your project root and include these lines, substituting your own firebase config property values for the ones included below:

VUE_APP_FIREBASE_API_KEY=AIza....jha4
VUE_APP_FIREBASE_AUTH_DOMAIN=fb-token-bug.firebaseapp.com
VUE_APP_FIREBASE_PROJECT_ID=fb-token-bug
VUE_APP_FIREBASE_STORAGE_BUCKET=fb-token-bug.appspot.com
VUE_APP_FIREBASE_MESSAGING_SENDER_ID=89....49
VUE_APP_FIREBASE_APP_ID=1:89....49:web:da8....864

Deploy location is hardcoded

The default configuration assumes your app will be deployed at the specified domain sub-path, e.g. https://foobar.com/fb-token-bug-v9/. If instead your app is deployed at the root of a domain, e.g. https://my-app.com/, delete the publicPath property in vue.config.js. Alternatively, you can edit the publicPath property to deploy to a different sub-path.

Compiles and hot-reloads for development

yarn serve

Compiles and minifies for production

yarn build

Lints and fixes files

yarn lint