User session management in Firebase - Commands & Configuration

Introduction

User session management helps keep track of who is logged into your app and for how long. It solves the problem of remembering users so they don't have to log in every time they open the app.

When you want users to stay logged in after closing and reopening your app.

When you need to check if a user is currently logged in before showing private content.

When you want to log out users automatically after a certain time for security.

When you want to refresh user login tokens to keep sessions active without asking for passwords again.

When you want to handle user sign-in and sign-out events smoothly in your app.

Commands

This command logs you into Firebase CLI so you can manage your Firebase projects and user authentication settings.

Terminal

firebase login

Expected Output

✔  Success! Logged in as [e-mail]

This initializes Firebase Authentication in your project, setting up the necessary files and configurations to manage user sessions.

Terminal

firebase init auth

Expected Output

✔  Firebase Authentication setup complete.

This deploys your authentication configuration to Firebase, making your user session management live and usable in your app.

Terminal

firebase deploy --only auth

Expected Output

=== Deploying to 'your-project-id'...



i  deploying auth

✔  auth: Finished running script.



✔  Deploy complete!

→

--only auth - Deploys only the authentication part of your Firebase project.

This exports your current users and their session data to a JSON file for backup or analysis.

Terminal

firebase auth:export users.json --format=json

Expected Output

Exported 10 users to users.json

→

--format=json - Exports user data in JSON format.

Key Concept

If you remember nothing else from this pattern, remember: managing user sessions means securely tracking who is logged in and keeping their login state active or expired as needed.

Common Mistakes

Not initializing Firebase Authentication before deploying.

Without initialization, the authentication service won't be set up, so user sessions can't be managed.

Always run 'firebase init auth' before deploying authentication settings.

Deploying the whole Firebase project instead of only authentication.

Deploying everything can take longer and may cause unintended changes in other services.

Use 'firebase deploy --only auth' to deploy just the authentication part.

Not logging into Firebase CLI before running commands.

Commands will fail because Firebase CLI needs your credentials to access your project.

Run 'firebase login' first to authenticate your CLI session.

Summary

Use 'firebase login' to authenticate your CLI session.

Initialize authentication with 'firebase init auth' to set up user session management.

Deploy authentication settings using 'firebase deploy --only auth' to make changes live.

Export user session data with 'firebase auth:export users.json --format=json' for backup or review.

Practice

1. What is the main purpose of user session management in Firebase?

easy

A. To keep track of who is logged in and maintain their login state safely

B. To store user data permanently in the database

C. To manage server resources automatically

D. To create user interface themes dynamically

Solution

1. Step 1: Understand user session management

   User session management is about tracking user login status and keeping users logged in securely.

2. Step 2: Identify the correct purpose in Firebase context

   Firebase Auth provides methods to manage user sessions, ensuring users stay logged in safely.

3. Final Answer:

   To keep track of who is logged in and maintain their login state safely -> Option A

4. Quick Check:

   User session management = track and maintain login state [OK]

Hint: Remember: session management = tracking login state [OK]

Common Mistakes:

• Confusing session management with data storage
• Thinking it manages server resources
• Mixing UI features with session handling

2. Which Firebase Auth method is used to sign out a user?

easy

A. firebase.auth().signOut()

B. firebase.auth().endSession()

C. firebase.auth().logOut()

D. firebase.auth().signIn()

Solution

1. Step 1: Recall Firebase Auth sign-out method

   The correct method to sign out a user in Firebase Auth is signOut().

2. Step 2: Verify method names

   Other options like signIn(), logOut(), and endSession() are incorrect or do not exist in Firebase Auth.

3. Final Answer:

   firebase.auth().signOut() -> Option A

4. Quick Check:

   Sign out method = signOut() [OK]

Hint: Sign out uses signOut(), not logOut or endSession [OK]

Common Mistakes:

• Using signIn() instead of signOut()
• Assuming logOut() or endSession() exist
• Confusing signOut() with session ending

3. What will be the output of this code snippet?

firebase.auth().onAuthStateChanged(user => {
  if (user) {
    console.log('User is signed in');
  } else {
    console.log('No user signed in');
  }
});

medium

A. Always logs 'User is signed in'

B. Logs 'User is signed in' if a user is logged in, else 'No user signed in'

C. Throws an error because of syntax

D. Logs nothing because the callback is never called

Solution

1. Step 1: Understand onAuthStateChanged behavior

   This method listens for changes in user authentication state and calls the callback with the user object or null.

2. Step 2: Analyze the callback logic

   If user exists (logged in), it logs 'User is signed in'; otherwise, it logs 'No user signed in'.

3. Final Answer:

   Logs 'User is signed in' if a user is logged in, else 'No user signed in' -> Option B

4. Quick Check:

   onAuthStateChanged logs based on user presence [OK]

Hint: onAuthStateChanged callback runs on login state changes [OK]

Common Mistakes:

• Thinking it always logs 'User is signed in'
• Expecting syntax errors in correct code
• Assuming callback never runs

4. Identify the error in this Firebase session persistence code:

firebase.auth().setPersistence('LOCAL')
  .then(() => {
    return firebase.auth().signInWithEmailAndPassword(email, password);
  })
  .catch(error => {
    console.error(error);
  });

medium

A. 'LOCAL' is not a valid persistence type

B. setPersistence must be called after signInWithEmailAndPassword

C. setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant

D. Missing await keyword before setPersistence

Solution

1. Step 1: Check setPersistence argument

   Firebase expects persistence constants like firebase.auth.Auth.Persistence.LOCAL, not string 'LOCAL'.

2. Step 2: Confirm correct usage

   Using the constant ensures valid persistence setting; strings cause errors.

3. Final Answer:

   setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant -> Option C

4. Quick Check:

   Use persistence constants, not strings [OK]

Hint: Use firebase.auth.Auth.Persistence constants, not strings [OK]

Common Mistakes:

• Passing string instead of constant for persistence
• Calling setPersistence after sign-in
• Forgetting to handle promises

5. You want users to stay signed in only during the browser session (not after closing). Which persistence setting should you use in Firebase Auth?

hard

A. firebase.auth.Auth.Persistence.LOCAL

B. firebase.auth.Auth.Persistence.NONE

C. firebase.auth.Auth.Persistence.PERMANENT

D. firebase.auth.Auth.Persistence.SESSION

Solution

1. Step 1: Understand persistence options

   LOCAL keeps users signed in across browser restarts, SESSION keeps them signed in only during the current tab session, NONE signs out immediately on page reload.

2. Step 2: Match requirement to persistence

   To keep users signed in only during the browser session, SESSION persistence is correct.

3. Final Answer:

   firebase.auth.Auth.Persistence.SESSION -> Option D

4. Quick Check:

   Session persistence = sign-in lasts only during browser session [OK]

Hint: SESSION persistence limits login to current browser session [OK]

Common Mistakes:

• Choosing LOCAL which persists beyond browser close
• Selecting NONE which signs out immediately
• Using non-existent PERMANENT option