User session management in Firebase - Step-by-Step Execution

Process Flow - User session management

User logs in

↓

Firebase creates session token

↓

Token stored on client

↓

User makes requests

↓

Firebase verifies token

↓

If token valid

→Allow access

No↓

Request denied, ask login

This flow shows how Firebase manages user sessions by creating a token at login, storing it on the client, verifying it on requests, and allowing or denying access.

Execution Sample

Firebase

firebase.auth().signInWithEmailAndPassword(email, password)
  .then(userCredential => {
    const user = userCredential.user;
    return user.getIdToken();
  })
  .then(token => {
    // Store token for session
  });

This code logs in a user with email and password, then gets a session token to manage the user session.

Process Table

Step	Action	Firebase Response	Client State	Next Step
1	User submits login form	Receives login request	No session token	Verify credentials
2	Firebase verifies credentials	Credentials valid	No session token	Create session token
3	Firebase creates session token	Token generated	No session token	Send token to client
4	Client receives token	Token sent	Stores token locally	User authenticated
5	User makes authenticated request	Receives request with token	Has token	Verify token validity
6	Firebase verifies token	Token valid	Has token	Allow access to resource
7	User makes request with expired token	Receives request with token	Has expired token	Reject request, ask login
8	User logs out	Session ended	Token removed from client	User unauthenticated

💡 Execution stops when user logs out or token expires and user must log in again.

Status Tracker

Variable	Start	After Step 3	After Step 4	After Step 6	After Step 8
sessionToken	null	null	token123abc	token123abc	null
userAuthenticated	false	false	true	true	false

Key Moments - 3 Insights

Why does the client store the session token after login?

The client stores the token (see execution_table step 4) so it can send it with future requests to prove the user is logged in.

What happens if the token expires before the user logs out?

At step 7, Firebase rejects requests with expired tokens, forcing the user to log in again to get a new token.

Does logging out immediately remove the token from Firebase?

No, logging out removes the token from the client (step 8), ending the session from the user's side.

Visual Quiz - 3 Questions

Look at the execution table, what is the client state after step 4?

A No session token stored

B User unauthenticated

C Session token stored locally

D Token expired

💡 Hint

Check the 'Client State' column at step 4 in the execution_table.

At which step does Firebase verify the token validity?

A Step 4

B Step 6

C Step 2

D Step 8

💡 Hint

Look for 'Firebase verifies token' in the 'Action' column of the execution_table.

If the user logs out, what happens to the sessionToken variable according to variable_tracker?

A It becomes null

B It changes to a new token

C It remains the same

D It becomes expired

💡 Hint

Check the 'sessionToken' row in variable_tracker after step 8.

Concept Snapshot

User session management in Firebase:
- User logs in with credentials
- Firebase creates a session token
- Token stored on client for future requests
- Firebase verifies token on each request
- Expired tokens cause access denial
- Logging out removes token from client

Full Transcript

User session management in Firebase starts when the user logs in with their email and password. Firebase checks the credentials and creates a session token if valid. This token is sent to the client and stored locally. When the user makes requests, the client sends the token to Firebase, which verifies it. If the token is valid, access is allowed. If the token expires or the user logs out, the session ends and the user must log in again to get a new token.