React-native-firebase: Uninstalling the app doesn't clear data cached by Firebase

[amsul]

Issue

Uninstalling the app doesn't clear data that Firebase caches - such as the logged in user.

As a result, what ends up happening is when a user removes the app and adds it again, they're already logged in. Not only is this a privacy concern, but it also causes issues such as not having an authorized Facebook session (if that was the authentication method) and so all requests to the Facebook API fail.

Is this intended behavior? If so, is there a way to opt out?

Environment

1. Application Target Platform:
   iOS

1. React Native version:
   0.50.3

1. RNFirebase Version:
   3.1.0

[Ehesp]

I believe this is intended as it's storing the data on key chain. There's
an issue been raised elsewhere which I'll look for once I'm not on the
phone.

On 18 Dec 2017 01:53, "amsul" [e-mail] wrote:

Issue

Uninstalling the app doesn't clear data that Firebase caches - such as the
logged in user.

As a result, what ends up happening is when a user removes the app and
adds it again, they're already logged in. Not only is this a privacy
concern, but it also causes issues such as not having an authorized
Facebook session (if that was the authentication method) and so all
requests to the Facebook API fail.

Is this intended behavior? If so, is there a way to opt out?
Environment

1. Application Target Platform:
   iOS

   1.

   React Native version:
   0.50.3
   2.

   RNFirebase Version:
   3.1.0

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/invertase/react-native-firebase/issues/694, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAzZXnMukP-tUrfZONXAi7jGy4ArxmkZks5tBcWcgaJpZM4RE46W
.

[ergunyasar]

@amsul I faced same problem and spent a lot of time regarding to that issue. I solved it like this. For ios I set a user default variable(boolean) then change its value after first run. If it is first run I simply sign out the user.

[FIRApp configure];

  NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
  if (![defaults boolForKey:@"notFirstRun"]) {
    [defaults setBool:YES forKey:@"notFirstRun"];
    [defaults synchronize];
    [[FIRAuth auth] signOut:NULL];
  }

Hope this helps.

[amsul]

@ergunyasar thanks! I'll def give that a shot

[Ehesp]

Going to close this one as it's something we can't fix.

[ollieh-m]

Thanks for your solution @ergunyasar - just wondering if you know whether this is an issue on android as well. And whether it's an issue with firebase database cache. I don't think that's on the keychain so assume it is deleted with app data but I'm not totally sure.

[cassaram09]

@ollieh-m I had a similar issue on Android, where the auth state still persisted even after uninstalling the app. I implemented a solution similar to what @ergunyasar suggested, except in React Native, but that didn't work for me. However, disabling backups in AndroidManifest.xml seemed to do the trick.

```
// Condensed for clarity.

xmlns:android="http://schemas.android.com/apk/res/android"
package="YOUR.APP.NAME."
android:versionCode="1"
android:versionName="0.0.0"
xmlns:tools="http://schemas.android.com/tools" // added this
>

<application
  tools:replace="android:allowBackup" // I added this to override another dependency - you may or may not need this
  android:name=".MainApplication"
  android:label="@string/app_name"
  android:icon="@drawable/icon"
  android:theme="@style/AppTheme"
  android:allowBackup="false"  // add to disable backups
>

[akiwarheit]

I had this issue on Android as well - uninstalling the app, then reinstalling showing the old config from Remote Config.

I assumed this was because the old instance was rate limited. Signing out of Google Drive fixed it (so it was definitely a backup issue)

Unfortunately this was a release build so I was unable to debug.

I had to add

tools:replace="android:allowBackup"
allowBackup=false

[mikehardy]

Just a note from an Android dev - android works very hard (if the user has configured it with their google account) to back up app data state so if they install the app on another device, or restore their device, all their settings and config are restored seamlessly. This helps with user device upgrades for instance. That's what "allowBackup" is doing - it is saying "this app's data is allowed to be included in google account app user data backups so restores work". You might consider leaving it on because it is a nice feature for users if they have taken time to configure your app, but to gate logins like above on first-run-after-install is a good thing in case of privacy concerns. Just disallowing backup entirely is user-unfriendly though obviously justifiable in certain situations.