User session management in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Firebase session expiration behavior

What happens when a Firebase user session token expires?

A The session token is silently refreshed without user interaction.

B The user is automatically signed out and must sign in again.

C The user session remains active indefinitely until manually signed out.

D The app crashes due to invalid token error.

💡 Hint

Think about how Firebase manages tokens behind the scenes.

Firebase automatically refreshes expired session tokens silently to keep the user signed in without interruption.

❓ security

intermediate

Securing Firebase sessions on client devices

Which practice best protects Firebase user sessions on client devices?

A Use Firebase SDK's built-in session management without manual token storage.

B Save the session token in a cookie without HttpOnly flag.

C Store the Firebase ID token in localStorage for easy access.

D Embed the session token directly in URLs for API calls.

💡 Hint

Consider what the Firebase SDK does by default to keep sessions secure.

Firebase SDK manages tokens securely and refreshes them automatically, so manual storage is unnecessary and risky.

❓ Architecture

advanced

Designing multi-device session sync with Firebase

You want users to stay signed in across multiple devices and see session changes instantly. Which Firebase feature helps achieve this?

A Use Firebase Authentication with Realtime Database listeners to sync session state.

B Use Firebase Authentication with Cloud Firestore offline persistence only.

C Use Firebase Authentication with onAuthStateChanged listener for real-time updates.

D Use Firebase Authentication with manual token polling every minute.

💡 Hint

Think about how Firebase notifies apps about authentication state changes.

The onAuthStateChanged listener triggers immediately when session state changes, keeping all devices updated in real time.

❓ Configuration

advanced

Configuring Firebase session persistence modes

Which Firebase Auth persistence mode keeps the user signed in only during the current browser tab session?

A firebase.auth.Auth.Persistence.LOCAL

B firebase.auth.Auth.Persistence.SESSION

C firebase.auth.Auth.Persistence.NONE

D firebase.auth.Auth.Persistence.PERMANENT

💡 Hint

Consider the difference between session and local storage persistence.

SESSION persistence keeps the user signed in only for the current tab session and clears on tab close.

✅ Best Practice

expert

Handling user sign-out to prevent session reuse

After a user signs out in Firebase, what is the best practice to prevent session reuse or token leakage?

A Reload the app without signing out to keep session intact.

B Only call firebase.auth().signOut() without clearing any local data.

C Manually delete the refresh token from Firebase backend after sign-out.

D Call firebase.auth().signOut() and clear all local app data related to the user.

💡 Hint

Think about what happens if local data remains after sign-out.

Signing out and clearing local data ensures no tokens or user info remain that could be reused maliciously.