Firebase-js-sdk: auth.onAuthStateChanged + firestore.onSnapshot cause infinite loop of calls to /token.

[notVitaliy]

[REQUIRED] Describe your environment

• Operating System version: Windows 10
• Browser version: Chrome && Firefox
• Firebase SDK version: >=7.10.0
• Firebase Product: Auth

[REQUIRED] Describe the problem

Calls to onAuthStateChanged and onIdTokenChanged send off a flurry of requests to securetoken.googleapis.com/v1/token until it responds with QUOTA_EXCEEDED. This only happens when the user is authenticated.

Steps to reproduce:

This error does not occur on Linux or macOS. I was not able to replicate it in a windows VM on Linux. It's only on windows in both firefox and chrome. However, I've only had success replicating with 2 windows machines and failed to replicate on another windows laptop.

1. Only windows (maybe?)
2. go to the stackblitz link
3. authenticate with email (random email + password should work)
4. uncomment line 42
5. refresh the app stackblitz preview window
6. check network tab, there should be 100's of requests

https://stackblitz.com/edit/firebase-issue-sandbox-vzdnt7

This is the strangest bug that I've run across and it took quite a bit to isolate the exact sequence of events that was causing it.

My initial thoughts are that calls to the firestore document snapshot are causing the onAuthStateChanged observer to trigger.

edit: I just did some more digging and this bug does not happen in 7.9.3 but does in 7.10.0

[samhorlbeck]

Interesting.. I'm not sure but I suspect this is more related to the Firestore SDK than Auth directly. I'm rerouting this to Firestore.

[var-const]

Thanks for reporting the issue. I will try to reproduce it and will post an update when I have one.

[lymeo]

same here

[var-const]

I'm really sorry, but I had no luck trying to reproduce this so far. I'm using a Windows 10 laptop and Chrome. The only significant change I made to the repro case is to change the project configuration. Can you please clarify a few things? (I have added numbers to the reproduction steps in your original message to make it easier to refer to them, I hope you don't mind)

• regarding step 4 -- after reloading the preview window, it's not necessary to sign in again to see the error, right?
• regarding step 2 -- do you create a new user or sign in as an existing user? (I tried both, though)
• regarding step 3 -- what is the significance of this step? Does the issue not reproduce if line 42 isn't commented out during the first run?
• does it matter which document to listen to in order to reproduce the issue?
• Can you please try to reproduce the issue in a clean Chrome profile (but please don't use Incognito, there is an active issue with Auth in Incognito mode)? I wonder if it might be somehow related to your environment (e.g. browser extensions).

Finally, could you please enable debug logging, reproduce the issue and share the resulting logs? (please omit any sensitive information)

[schmidt-sebastian]

This is likely caused by https://github.com/firebase/firebase-js-sdk/pull/3184 (... but that was only released with v7.15.1).

[schmidt-sebastian]

@notVitaliy Can you confirm that this indeed already broke with v7.10? Thank you.

[notVitaliy]

Yep, I was able to re-create the issue starting with 7.10.

@var-const I'll get back to you on those questions sometime tomorrow.

[nmggithub]

I have had this issue for a while now, but have ignored it as I didn't know how to fix it. Strangely, it only appears to happen on Windows for me. Linux does not have the issue.

[Xstyler85]

I have the same problem, auth is looping https://securetoken.googleapis.com/v1/token?key=...
until error: {code: 400, message: "QUOTA_EXCEEDED", status: "INVALID_ARGUMENT"}

[schmidt-sebastian]

@Xstyler85 What version of Firestore are you using?

[Xstyler85]

@schmidt-sebastian I'm using "@firebase/app": "^0.6.6" I will try to update.

[schmidt-sebastian]

The latest version of Firestore has a number of changes that should improve our authentication state handling. Please let us know if you can reproduce using a newer version.

[Xstyler85]

@schmidt-sebastian upgrading on version "0.6.8" solved all problems for me.
Thank you for your help!

[schmidt-sebastian]

Closing as there are no active reports.

If more reports surface, we may want to merge https://github.com/firebase/firebase-js-sdk/pull/3260

[Xstyler85]

@schmidt-sebastian I'm very sorry, but I was looking at the "JS" filter instead of the "XHR" filter by mistake.
It's a little different, now It's looping auth.esm.js:204 and index.esm.js:906

[schmidt-sebastian]

@Xstyler85 Can you clarify what index.esm.js are you referring to? What version?

Line 906 of @firebase/[email protected] is toBase64(), which seems unlikely.

[Redmega]

We're facing the same issue in our app, we use auth.onIdTokenChanged() and in Sentry we frequently see the quota error following many calls to securetoken.googleapis.com/v1/token.

[Redmega]

Forgot to mention, perhaps very important for a possible fix, is that we use firebase, not firestore.

[schmidt-sebastian]

@Redmega Do you not use firestore at all? Or via @firebase/firestore?

[Redmega]

Not at all. This is solely with the firebase base package (and the realtime database), which makes me think that maybe this is a deeper rooted issue in the auth package (or the interfaces by which the realtime database and firestore communicate with auth.

[Redmega]

If it helps I can confirm all the rest of the details are the same -- It seems to only affect _some_ Windows users, regardless of browser.

It also interferes with sign in's, though this might be a result of googleapis and not the sdk -- the user is kicked back to the login page after the id token errors out (due to application logic when missing an authed user), and when they attempt to login the call to auth.signInWithEmailAndPassword() _also_ gets blocked due to quota.

[s-pyadyshev]

Have the same issue with infinite loop of get token requests after google sign in (signInWithPopup). Windows 10, firebase/app 0.6.10. https://github.com/s-pyadyshev/sdsh-react-mobx

[schmidt-sebastian]

cc @avolkovi Adding Alex, since this seems to no longer be Firestore specific. Note that there might not be much we can do here, but the good news is that we are rewriting Firebase Auth from scratch.

[nmggithub]

This issue is still happening for me on Windows. Thank you for looking more into this.

[lymeo]

Have same issue with firebase/auth and signInWithEmailAndPassword on vue js making authentication impossible

Once signInWithEmailAndPassword called infinite calls to firebase are made until error:

{
  "error": {
    "code": 400,
    "message": "QUOTA_EXCEEDED",
    "status": "INVALID_ARGUMENT"
  }
}

[zeari]

@lymeo I am experiencing exactly this on mac + chrome.

[shiro]

Got the same issue on linux, it went away after correcting my system timezone setting which was incorrect.

[nmggithub]

Got the same issue on linux, it went away after correcting my system timezone setting which was incorrect.

I think you may be onto something. It's never happened for me on Linux, but I know Windows and Linux store dates differently. So this could be part of the issue.

[JuxhinB]

iMac - Catalina 10.15.7

1. Chrome Version 85.0.4183.121 Loop Problem
2. Firefox Developer Version 82.0b5 (64-bit) Loop Problem

MacBookPro - Catalina 10.15.7

1. Chrome Version 85.0.3987.132 Everything is Fine
2. Firefox Developer Version 82.0b3 (64-bit) Everything is Fine

Is there any update?

[JuxhinB]

Have same issue with firebase/auth and signInWithEmailAndPassword on vue js making authentication impossible

Once signInWithEmailAndPassword called infinite calls to firebase are made until error:

{
  "error": {
    "code": 400,
    "message": "QUOTA_EXCEEDED",
    "status": "INVALID_ARGUMENT"
  }
}

Similar to your problem. I have a NextJs app.

[JuxhinB]

Got the same issue on linux, it went away after correcting my system timezone setting which was incorrect.

Fixed time zone in my iMac everything back to normality now.

[blinkofaneye]

Same, on windows only with @firebase 7.22.0 has this problem but 7.9.3 works fine.

[blinkofaneye]

I have a dual boot with debian next to windows and the date on my windows was incorrect, it was fixed after i set the correct date and time. Maybe it can help you to solve this issue.

[MaximeHeckel]

Got the same issue on linux, it went away after correcting my system timezone setting which was incorrect.

Fixed time zone in my iMac everything back to normality now.

@JuxhinB

Are we sure that this is a potential fix?
Customers of the product I'm working on are running into that same issue.

[MaximeHeckel]

Ok confirmed with our customer: it was a clock skew issue on their end 🤦‍♂️

[yusufkandemir]

Another reproduction:
https://stackblitz.com/edit/firebase-issue-sandbox-iuvdtf?file=index.js

Instructions:

1. Make sure your device's time is correct.
2. Create an account yourself, any e-mail would be accepted. Or, log in with these credentials:
   E-mail: "[email protected]"
   Password: "Passw0rd"
3. Check the network tab and confirm that there are no crazy amount of requests constantly being made to /token and /channel.
4. Change your device's time to a future time, for example, set it to 1 hour and 14 minutes later.
5. Either log out and repeat steps 2 and 3, or refresh the page.
6. See the crazy amount of requests that are being made to /token and /channel constantly in the network tab.

If you press log out, you will no longer see those requests.
This amount of requests will result in quota exceed errors and high read counts thus a crazy increase in bills and bad UX.

This issue should be fixed and handled in the SDK. Otherwise, any person with harmful intentions can just use this exploit to cause high bills.

[mikerowe81]

Are you kidding me??!!! It was the timezone?!?!?

Just did a new Windows install (not for this issue) and ran into this issue not realizing my timezone was wrong (Thank you Microsoft for defaulting to Pacific Time.....Windows tries to enable every other configuration, but stopped at "Set time zone automatically", really!!!???? someone please buy me a Chromebook!!!).

Spent all day troubleshooting trying to figure out why it was working on some machines and not others. FWIW, my issue occurred when a user is authenticated and I run firebase.firestore() and it doesn't have to be in that order. Also, I narrowed it down to starting in 7.11 and I don't have the issue in 7.10. Thought it might be related to the "Added multi-factor authentication support for Google Cloud Identity Platform projects." feature added in 7.11

Even built a nice test site here: https://apaggello.web.app/

The looping URL for anyone searching this is https://securetoken.googleapis.com/v1/token?key=xxxxxxxxxx

Please fix it for the sanity of the next person that might run into this, thank you!!!!

[yusufkandemir]

4210 solved this problem(released on v8.2.1), I can't reproduce the problem anymore. I guess this issue can be closed after some time and feedback from other people just in case.

[JuxhinB]

Got the same issue on linux, it went away after correcting my system timezone setting which was incorrect.

Fixed time zone in my iMac everything back to normality now.

@JuxhinB

Are we sure that this is a potential fix?
Customers of the product I'm working on are running into that same issue.

Sorry for the late reply, but yes, this fixed the problem for me. I spent more than half a day to understand why in my laptop I didn't have the issue while on pc I did.