Firebase-ios-sdk: iOS holds invalid cache of Auth Emulator User even after Auth Emulator deletion

[henrymoulton]

Step 1: Describe your environment

• Xcode version: 12.1
• Firebase SDK version:

- Firebase/Analytics (7.1.0):
    - Firebase/Core
  - Firebase/Auth (7.1.0):
    - Firebase/CoreOnly
    - FirebaseAuth (~> 7.1.0)
  - Firebase/Core (7.1.0):
    - Firebase/CoreOnly
    - FirebaseAnalytics (= 7.1.0)
  - Firebase/CoreOnly (7.1.0):
    - FirebaseCore (= 7.1.0)
  - Firebase/Firestore (7.1.0):
    - Firebase/CoreOnly
    - FirebaseFirestore (~> 7.1.0)
  - FirebaseAnalytics (7.1.0):
    - FirebaseCore (~> 7.0)
    - FirebaseInstallations (~> 7.0)

• Installation method: CocoaPods (select one)
• Firebase Component: Auth

Step 2: Describe the problem

Steps to reproduce:

When developing I can clear users from the auth emulator but find the state for the now-deleted signed in user is still held on the iOS simulator.

If you have a downloadable sample project that reproduces the bug you're reporting, you will
likely receive a faster response on your issue.

Relevant Code:

export const fbAuth = auth();
if (IS_FIREBASE_EMULATOR_ON) {
  fbAuth.useEmulator("http://localhost:9099");
}

// later in a component...

const [user] = useAuthState(fbAuth); 
console.log({ user }); // outputs user that was deleted from emulator.

I filed this in https://github.com/invertase/react-native-firebase/issues/4606 and one of the maintainers said that this is normal behaviour. If so it'd be good to have documented inside the Auth Emulator docs.

Happy to answer additional questions.

[strom2357]

Thanks for reporting! We're tracking this internally at b/174249677 and will follow up if we need any more information.

[mikehardy]

Just for clarity, since I'm the react-native-firebase maintainer mentioned - is this normal behavior? That you can delete a user in the emulator (or in the real user database), and the user still exists (edit based on reply below: but the tokens are invalidated) in the client? I was pretty sure this is just the nature of a token-based system and is expected, and if I'm wrong I need to correct my understanding :-). Thanks

[rosalyntan]

Hi @henrymoulton, thanks for filing an issue! @mikehardy is correct -- this is normal behavior, and is not specific to the auth emulator. When a user is deleted from the emulator or the console, the user may still be cached on the client. However, attempting to use the cached token after the user is deleted should fail.