Custom authentication tokens in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a Firebase custom token expires?

You create a Firebase custom authentication token with a 1-hour expiration. What happens if a client tries to use this token after it expires?

A The client is denied access and must request a new token to authenticate again.

B The client can continue using the expired token without interruption.

C Firebase automatically refreshes the token without client intervention.

D The client is permanently blocked from accessing Firebase services.

💡 Hint

Think about how tokens maintain security by limiting their valid time.

Firebase custom tokens expire after their set time. Clients must get a new token to continue authenticating. Expired tokens are rejected to keep access secure.

❓ Configuration

intermediate

Which Firebase Admin SDK method creates a custom token?

You want to generate a custom authentication token for a user with ID 'user123'. Which Firebase Admin SDK method correctly creates this token?

A admin.auth().signInWithCustomToken('user123')

B admin.auth().generateToken('user123')

C admin.auth().createCustomToken('user123')

D admin.auth().getCustomToken('user123')

💡 Hint

Look for the method that explicitly mentions 'create' and 'CustomToken'.

The Firebase Admin SDK uses createCustomToken(uid) to generate a custom token for a user ID. Other methods do not exist or serve different purposes.

❓ security

advanced

What is the best practice to secure the private key used for signing Firebase custom tokens?

You have a private key to sign Firebase custom tokens. Which practice best protects this key?

A Store the private key in a secure environment variable or secret manager, never in client code.

B Embed the private key directly in the client app for faster token generation.

C Share the private key with all developers via email for easy access.

D Commit the private key to the public source code repository for transparency.

💡 Hint

Think about who should have access to sensitive keys and where they should be stored.

Private keys must be kept secret and stored securely, such as in environment variables or secret managers. Exposing keys in client code or public repos risks compromise.

❓ Architecture

advanced

How should you architect a system to issue Firebase custom tokens for users authenticated by an external system?

You have an external user database and want to allow those users to access Firebase services using custom tokens. What architecture best supports this?

A Use Firebase client SDK to create custom tokens without backend verification.

B Allow clients to generate custom tokens directly using the Firebase Admin SDK in the frontend.

C Store Firebase private keys in the external user database for token generation.

D Create a secure backend service that verifies external user credentials and issues Firebase custom tokens on demand.

💡 Hint

Consider where sensitive operations like token signing should happen.

A secure backend service should verify external users and generate custom tokens. This keeps private keys safe and ensures only valid users get tokens.

🧠 Conceptual

expert

What is the main difference between Firebase custom tokens and ID tokens?

Firebase uses both custom tokens and ID tokens in authentication. What is the key difference between them?

A ID tokens are created by your backend; custom tokens are issued by Firebase after sign-in.

B Custom tokens are short-lived tokens created by your backend to sign in users; ID tokens are issued by Firebase after sign-in and used to authorize requests.

C Custom tokens and ID tokens are the same and can be used interchangeably.

D ID tokens are used only for anonymous users; custom tokens are for registered users.

💡 Hint

Think about who creates each token and when they are used.

Custom tokens are created by your backend to sign in users. After sign-in, Firebase issues ID tokens to the client to authorize requests. They serve different roles.

Practice

1. What is the main purpose of Firebase custom authentication tokens?

easy

A. To store user data in Firebase Realtime Database

B. To sign in users from your own system to Firebase

C. To send notifications to users

D. To create Firebase projects automatically

Solution

1. Step 1: Understand the role of custom tokens

   Custom tokens are used to authenticate users from an external system with Firebase.

2. Step 2: Identify the correct purpose

   They allow users to sign in securely using tokens generated on your server.

3. Final Answer:

   To sign in users from your own system to Firebase -> Option B

4. Quick Check:

   Custom tokens = sign in users [OK]

Hint: Custom tokens = external user sign-in method [OK]

Common Mistakes:

• Confusing tokens with data storage
• Thinking tokens send notifications
• Assuming tokens create projects

2. Which Firebase Admin SDK method is used to create a custom authentication token?

easy

A. admin.auth().createCustomToken(uid)

B. admin.database().createToken(uid)

C. firebase.auth().signInWithCustomToken(uid)

D. admin.storage().generateToken(uid)

Solution

1. Step 1: Identify the correct Admin SDK service

   Custom tokens are created using the Authentication service, not database or storage.

2. Step 2: Match the correct method

   The method to create a custom token is createCustomToken(uid) under admin.auth().

3. Final Answer:

   admin.auth().createCustomToken(uid) -> Option A

4. Quick Check:

   Custom token creation = admin.auth().createCustomToken [OK]

Hint: Use admin.auth().createCustomToken to generate tokens [OK]

Common Mistakes:

• Using database or storage methods incorrectly
• Confusing signInWithCustomToken with token creation
• Calling methods on firebase instead of admin SDK

3. What will the following code output if uid is 'user123' and no errors occur?

const admin = require('firebase-admin');
admin.initializeApp();

admin.auth().createCustomToken('user123')
  .then(token => console.log(typeof token))
  .catch(error => console.error(error));

medium

A. 'object'

B. An error message

C. 'undefined'

D. 'string'

Solution

1. Step 1: Understand createCustomToken return type

   The method returns a Promise that resolves to a string token.

2. Step 2: Check console.log output

   Logging typeof token will print 'string' because the token is a string.

3. Final Answer:

   'string' -> Option D

4. Quick Check:

   createCustomToken returns string token [OK]

Hint: createCustomToken returns a string token inside a Promise [OK]

Common Mistakes:

• Expecting an object instead of string
• Confusing token with undefined
• Assuming an error without cause

4. Identify the error in this code snippet for generating a custom token:

const admin = require('firebase-admin');

admin.auth().createCustomToken('12345')
  .then(token => console.log(token))
  .catch(error => console.error(error));

medium

A. Missing admin.initializeApp() call

B. Incorrect method name, should be generateCustomToken

C. createCustomToken does not return a Promise

D. UID must be a string, not a number

Solution

1. Step 1: Check initialization of Firebase Admin SDK

   The admin SDK must be initialized with admin.initializeApp() before use.

2. Step 2: Verify other parts

   The UID '12345' is a valid string, createCustomToken returns a Promise, and method name is correct.

3. Final Answer:

   Missing admin.initializeApp() call -> Option A

4. Quick Check:

   Initialize admin SDK before calling methods [OK]

Hint: Always call admin.initializeApp() before using admin SDK [OK]

Common Mistakes:

• Passing number instead of string UID
• Assuming createCustomToken is synchronous
• Using wrong method name

5. You want to add extra user info like role: 'admin' in a custom token. Which code snippet correctly adds this claim?

hard

A. admin.auth().setCustomUserClaims(uid, { role: 'admin' })

B. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' })

C. admin.auth().createCustomToken(uid, { role: 'admin' })

D. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } })

Solution

1. Step 1: Understand how to add extra claims in custom tokens

   The createCustomToken method accepts a second argument with additional claims as a plain object.

2. Step 2: Evaluate each option

   admin.auth().createCustomToken(uid, { role: 'admin' }) correctly passes extra claims as second argument. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' }) is invalid chaining. admin.auth().setCustomUserClaims(uid, { role: 'admin' }) sets claims on user but not in token creation. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } }) nests claims incorrectly.

3. Final Answer:

   admin.auth().createCustomToken(uid, { role: 'admin' }) -> Option C

4. Quick Check:

   Extra claims go as second argument in createCustomToken [OK]

Hint: Pass extra claims as second argument to createCustomToken [OK]

Common Mistakes:

• Trying to chain setClaims on token creation
• Using setCustomUserClaims instead of token claims
• Nesting claims inside another object