User session management in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Firebase session expiration behavior

What happens when a Firebase user session token expires?

A The session token is silently refreshed without user interaction.

B The user is automatically signed out and must sign in again.

C The user session remains active indefinitely until manually signed out.

D The app crashes due to invalid token error.

💡 Hint

Think about how Firebase manages tokens behind the scenes.

Firebase automatically refreshes expired session tokens silently to keep the user signed in without interruption.

❓ security

intermediate

Securing Firebase sessions on client devices

Which practice best protects Firebase user sessions on client devices?

A Use Firebase SDK's built-in session management without manual token storage.

B Save the session token in a cookie without HttpOnly flag.

C Store the Firebase ID token in localStorage for easy access.

D Embed the session token directly in URLs for API calls.

💡 Hint

Consider what the Firebase SDK does by default to keep sessions secure.

Firebase SDK manages tokens securely and refreshes them automatically, so manual storage is unnecessary and risky.

❓ Architecture

advanced

Designing multi-device session sync with Firebase

You want users to stay signed in across multiple devices and see session changes instantly. Which Firebase feature helps achieve this?

A Use Firebase Authentication with Realtime Database listeners to sync session state.

B Use Firebase Authentication with Cloud Firestore offline persistence only.

C Use Firebase Authentication with onAuthStateChanged listener for real-time updates.

D Use Firebase Authentication with manual token polling every minute.

💡 Hint

Think about how Firebase notifies apps about authentication state changes.

The onAuthStateChanged listener triggers immediately when session state changes, keeping all devices updated in real time.

❓ Configuration

advanced

Configuring Firebase session persistence modes

Which Firebase Auth persistence mode keeps the user signed in only during the current browser tab session?

A firebase.auth.Auth.Persistence.LOCAL

B firebase.auth.Auth.Persistence.SESSION

C firebase.auth.Auth.Persistence.NONE

D firebase.auth.Auth.Persistence.PERMANENT

💡 Hint

Consider the difference between session and local storage persistence.

SESSION persistence keeps the user signed in only for the current tab session and clears on tab close.

✅ Best Practice

expert

Handling user sign-out to prevent session reuse

After a user signs out in Firebase, what is the best practice to prevent session reuse or token leakage?

A Reload the app without signing out to keep session intact.

B Only call firebase.auth().signOut() without clearing any local data.

C Manually delete the refresh token from Firebase backend after sign-out.

D Call firebase.auth().signOut() and clear all local app data related to the user.

💡 Hint

Think about what happens if local data remains after sign-out.

Signing out and clearing local data ensures no tokens or user info remain that could be reused maliciously.

Practice

1. What is the main purpose of user session management in Firebase?

easy

A. To keep track of who is logged in and maintain their login state safely

B. To store user data permanently in the database

C. To manage server resources automatically

D. To create user interface themes dynamically

Solution

1. Step 1: Understand user session management

   User session management is about tracking user login status and keeping users logged in securely.

2. Step 2: Identify the correct purpose in Firebase context

   Firebase Auth provides methods to manage user sessions, ensuring users stay logged in safely.

3. Final Answer:

   To keep track of who is logged in and maintain their login state safely -> Option A

4. Quick Check:

   User session management = track and maintain login state [OK]

Hint: Remember: session management = tracking login state [OK]

Common Mistakes:

• Confusing session management with data storage
• Thinking it manages server resources
• Mixing UI features with session handling

2. Which Firebase Auth method is used to sign out a user?

easy

A. firebase.auth().signOut()

B. firebase.auth().endSession()

C. firebase.auth().logOut()

D. firebase.auth().signIn()

Solution

1. Step 1: Recall Firebase Auth sign-out method

   The correct method to sign out a user in Firebase Auth is signOut().

2. Step 2: Verify method names

   Other options like signIn(), logOut(), and endSession() are incorrect or do not exist in Firebase Auth.

3. Final Answer:

   firebase.auth().signOut() -> Option A

4. Quick Check:

   Sign out method = signOut() [OK]

Hint: Sign out uses signOut(), not logOut or endSession [OK]

Common Mistakes:

• Using signIn() instead of signOut()
• Assuming logOut() or endSession() exist
• Confusing signOut() with session ending

3. What will be the output of this code snippet?

firebase.auth().onAuthStateChanged(user => {
  if (user) {
    console.log('User is signed in');
  } else {
    console.log('No user signed in');
  }
});

medium

A. Always logs 'User is signed in'

B. Logs 'User is signed in' if a user is logged in, else 'No user signed in'

C. Throws an error because of syntax

D. Logs nothing because the callback is never called

Solution

1. Step 1: Understand onAuthStateChanged behavior

   This method listens for changes in user authentication state and calls the callback with the user object or null.

2. Step 2: Analyze the callback logic

   If user exists (logged in), it logs 'User is signed in'; otherwise, it logs 'No user signed in'.

3. Final Answer:

   Logs 'User is signed in' if a user is logged in, else 'No user signed in' -> Option B

4. Quick Check:

   onAuthStateChanged logs based on user presence [OK]

Hint: onAuthStateChanged callback runs on login state changes [OK]

Common Mistakes:

• Thinking it always logs 'User is signed in'
• Expecting syntax errors in correct code
• Assuming callback never runs

4. Identify the error in this Firebase session persistence code:

firebase.auth().setPersistence('LOCAL')
  .then(() => {
    return firebase.auth().signInWithEmailAndPassword(email, password);
  })
  .catch(error => {
    console.error(error);
  });

medium

A. 'LOCAL' is not a valid persistence type

B. setPersistence must be called after signInWithEmailAndPassword

C. setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant

D. Missing await keyword before setPersistence

Solution

1. Step 1: Check setPersistence argument

   Firebase expects persistence constants like firebase.auth.Auth.Persistence.LOCAL, not string 'LOCAL'.

2. Step 2: Confirm correct usage

   Using the constant ensures valid persistence setting; strings cause errors.

3. Final Answer:

   setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant -> Option C

4. Quick Check:

   Use persistence constants, not strings [OK]

Hint: Use firebase.auth.Auth.Persistence constants, not strings [OK]

Common Mistakes:

• Passing string instead of constant for persistence
• Calling setPersistence after sign-in
• Forgetting to handle promises

5. You want users to stay signed in only during the browser session (not after closing). Which persistence setting should you use in Firebase Auth?

hard

A. firebase.auth.Auth.Persistence.LOCAL

B. firebase.auth.Auth.Persistence.NONE

C. firebase.auth.Auth.Persistence.PERMANENT

D. firebase.auth.Auth.Persistence.SESSION

Solution

1. Step 1: Understand persistence options

   LOCAL keeps users signed in across browser restarts, SESSION keeps them signed in only during the current tab session, NONE signs out immediately on page reload.

2. Step 2: Match requirement to persistence

   To keep users signed in only during the browser session, SESSION persistence is correct.

3. Final Answer:

   firebase.auth.Auth.Persistence.SESSION -> Option D

4. Quick Check:

   Session persistence = sign-in lasts only during browser session [OK]

Hint: SESSION persistence limits login to current browser session [OK]

Common Mistakes:

• Choosing LOCAL which persists beyond browser close
• Selecting NONE which signs out immediately
• Using non-existent PERMANENT option