User session management in Firebase - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a user session in Firebase Authentication?

A user session is the period during which a user is signed in and their identity is remembered by the app, allowing access to protected resources without re-authenticating.

beginner

How does Firebase keep a user signed in across app restarts?

Firebase stores the user's authentication token securely on the device and automatically refreshes it, so the user stays signed in even after closing and reopening the app.

beginner

What method do you use to sign out a user in Firebase?

You use the signOut() method from Firebase Authentication to end the user session and clear the stored authentication state.

intermediate

Why is session expiration important in user session management?

Session expiration limits how long a user stays signed in to protect security, ensuring that old sessions don’t allow unauthorized access if a device is lost or shared.

intermediate

What is the role of refresh tokens in Firebase user sessions?

Refresh tokens allow Firebase to get new access tokens without asking the user to sign in again, keeping the session active securely in the background.

Which Firebase method signs out the current user?

A signOut()

B logOut()

C endSession()

D closeSession()

The correct method to sign out a user in Firebase Authentication is signOut().

How does Firebase keep users signed in after app restarts?

A By saving the password in plain text

B By asking the user to sign in every time

C By storing authentication tokens securely and refreshing them automatically

D By disabling session expiration

Firebase securely stores tokens and refreshes them to keep users signed in without asking for credentials repeatedly.

What happens when you call signOut() in Firebase?

A The user session is extended

B The user session ends and authentication state is cleared

C The user password is reset

D The app crashes

Calling signOut() ends the user session and clears stored authentication data.

Why are refresh tokens important in Firebase sessions?

A They delete user data

B They store user passwords

C They log user activity

D They allow renewing access tokens without user sign-in

Refresh tokens let Firebase get new access tokens silently to keep sessions active.

What is a key security reason for session expiration?

A To prevent unauthorized access if a device is lost

B To make users sign in more often for fun

C To slow down the app

D To save battery life

Session expiration helps protect user accounts by limiting how long a session stays valid.

Explain how Firebase manages user sessions to keep users signed in securely.

Think about what happens behind the scenes after a user logs in.

Describe the steps and importance of signing out a user in Firebase.

Consider what happens when a user wants to stop using the app.

Practice

1. What is the main purpose of user session management in Firebase?

easy

A. To keep track of who is logged in and maintain their login state safely

B. To store user data permanently in the database

C. To manage server resources automatically

D. To create user interface themes dynamically

Solution

1. Step 1: Understand user session management

   User session management is about tracking user login status and keeping users logged in securely.

2. Step 2: Identify the correct purpose in Firebase context

   Firebase Auth provides methods to manage user sessions, ensuring users stay logged in safely.

3. Final Answer:

   To keep track of who is logged in and maintain their login state safely -> Option A

4. Quick Check:

   User session management = track and maintain login state [OK]

Hint: Remember: session management = tracking login state [OK]

Common Mistakes:

• Confusing session management with data storage
• Thinking it manages server resources
• Mixing UI features with session handling

2. Which Firebase Auth method is used to sign out a user?

easy

A. firebase.auth().signOut()

B. firebase.auth().endSession()

C. firebase.auth().logOut()

D. firebase.auth().signIn()

Solution

1. Step 1: Recall Firebase Auth sign-out method

   The correct method to sign out a user in Firebase Auth is signOut().

2. Step 2: Verify method names

   Other options like signIn(), logOut(), and endSession() are incorrect or do not exist in Firebase Auth.

3. Final Answer:

   firebase.auth().signOut() -> Option A

4. Quick Check:

   Sign out method = signOut() [OK]

Hint: Sign out uses signOut(), not logOut or endSession [OK]

Common Mistakes:

• Using signIn() instead of signOut()
• Assuming logOut() or endSession() exist
• Confusing signOut() with session ending

3. What will be the output of this code snippet?

firebase.auth().onAuthStateChanged(user => {
  if (user) {
    console.log('User is signed in');
  } else {
    console.log('No user signed in');
  }
});

medium

A. Always logs 'User is signed in'

B. Logs 'User is signed in' if a user is logged in, else 'No user signed in'

C. Throws an error because of syntax

D. Logs nothing because the callback is never called

Solution

1. Step 1: Understand onAuthStateChanged behavior

   This method listens for changes in user authentication state and calls the callback with the user object or null.

2. Step 2: Analyze the callback logic

   If user exists (logged in), it logs 'User is signed in'; otherwise, it logs 'No user signed in'.

3. Final Answer:

   Logs 'User is signed in' if a user is logged in, else 'No user signed in' -> Option B

4. Quick Check:

   onAuthStateChanged logs based on user presence [OK]

Hint: onAuthStateChanged callback runs on login state changes [OK]

Common Mistakes:

• Thinking it always logs 'User is signed in'
• Expecting syntax errors in correct code
• Assuming callback never runs

4. Identify the error in this Firebase session persistence code:

firebase.auth().setPersistence('LOCAL')
  .then(() => {
    return firebase.auth().signInWithEmailAndPassword(email, password);
  })
  .catch(error => {
    console.error(error);
  });

medium

A. 'LOCAL' is not a valid persistence type

B. setPersistence must be called after signInWithEmailAndPassword

C. setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant

D. Missing await keyword before setPersistence

Solution

1. Step 1: Check setPersistence argument

   Firebase expects persistence constants like firebase.auth.Auth.Persistence.LOCAL, not string 'LOCAL'.

2. Step 2: Confirm correct usage

   Using the constant ensures valid persistence setting; strings cause errors.

3. Final Answer:

   setPersistence should use firebase.auth.Auth.Persistence.LOCAL constant -> Option C

4. Quick Check:

   Use persistence constants, not strings [OK]

Hint: Use firebase.auth.Auth.Persistence constants, not strings [OK]

Common Mistakes:

• Passing string instead of constant for persistence
• Calling setPersistence after sign-in
• Forgetting to handle promises

5. You want users to stay signed in only during the browser session (not after closing). Which persistence setting should you use in Firebase Auth?

hard

A. firebase.auth.Auth.Persistence.LOCAL

B. firebase.auth.Auth.Persistence.NONE

C. firebase.auth.Auth.Persistence.PERMANENT

D. firebase.auth.Auth.Persistence.SESSION

Solution

1. Step 1: Understand persistence options

   LOCAL keeps users signed in across browser restarts, SESSION keeps them signed in only during the current tab session, NONE signs out immediately on page reload.

2. Step 2: Match requirement to persistence

   To keep users signed in only during the browser session, SESSION persistence is correct.

3. Final Answer:

   firebase.auth.Auth.Persistence.SESSION -> Option D

4. Quick Check:

   Session persistence = sign-in lasts only during browser session [OK]

Hint: SESSION persistence limits login to current browser session [OK]

Common Mistakes:

• Choosing LOCAL which persists beyond browser close
• Selecting NONE which signs out immediately
• Using non-existent PERMANENT option