Why firebase user still signed in after I deleted it from firebase dashboard

Question

I used Firebase Quickstarts for Android Auth sample, Then I created a user in firebase dashboard to login the user with email and password, the user logged in successfully. But when I deleted the user, it still logged in and showing the old user's email from (user.getEmail())

// [START auth_state_listener]
    mAuthListener = new FirebaseAuth.AuthStateListener() {
        @Override
        public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {
            FirebaseUser user = firebaseAuth.getCurrentUser();
            if (user != null) {
                // User is signed in
                Log.d(TAG, "onAuthStateChanged:signed_in:" + user.getEmail());
            } else {
                // User is signed out
                Log.d(TAG, "onAuthStateChanged:signed_out");
            }
            // [START_EXCLUDE]
            updateUI(user);
            // [END_EXCLUDE]
        }
    };
    // [END auth_state_listener]

No users in my firebase dashboard and the AuthStateListener indecate that the user is signed in.

how could that be possible ?

Deleting a user account does not expire their session. See http://stackoverflow.com/questions/35960546/firebase-still-retrieving-authdata-after-deletion/35961217#35961217 — Frank van Puffelen, Jun 09 '16 at 18:58
How can we delete a signed in user session then ? Guess i have that session problem here in my [post](http://stackoverflow.com/q/43983867/7004388) — coderpc, May 15 '17 at 16:19

Anisuzzaman Babla · Answer 1 · 2021-01-17T05:22:47.760

Deleting an account does not automatically expire the current session(s) for that account. Their current sessions will remain valid until they expire. You can set the session expiration interval in your Firebase Dashboard.

If you want to force the user to be logged out, call ref.unauth().

When a user updates their email, password or resets their password. Firebase Auth backend revokes their tokens requiring that they reauthenticate or try to sign in again. This is a security feature. For example a user may reset their password if their account was compromised. All other sessions must reauthenticate.

If you keep the user profiles in your database, you can check whether that record still exists in your security rules: root.child('users').child(auth.uid).exists().

Also see:

Why firebase user still signed in after I deleted it from firebase dashboard

1 Answers1

Linked

Related