-
Notifications
You must be signed in to change notification settings - Fork 376
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Differentiating between invalid and expired tokens when verifying #179
Comments
Hmmm this issue does not seem to follow the issue template. Make sure you provide all the required information. |
Sounds reasonable to me. @bojeil-google what do you think? Shall we introduce a new |
In general, I think it is a good idea but I think this could be a breaking change. Developers may be expecting the current error code for both. If we add a new error code, they would basically miss it (they won't be catching it). I suggest we keep this until the next major version bump. |
While waiting for the next major version bump would it be possible as per my second suggestion to surface the original |
It's going to be hard to justify an API change that will become unnecessary a few months later. What if we modify the error message ( |
How about |
Yes, that sounds reasonable. @simenbrekken would you be able to give us a patch? |
Certainly. I'll have a patch ready this weekend. |
Is this change still on roadmap? I see major release is out and this issue is closed but |
It's still on roadmap. Just haven't gotten around to it yet. |
Environment
Description
There's currently no robust way to detect if an id token is invalid or has expired when performing verification via
auth().verifyIdToken
other than checking if the actualerror.message
contains the string "expired".The
verifyIdToken
implementation oftoken-generator
correctly detects expired tokens by checking forerror.name === 'TokenExpiredError'
but this error code is discarded as it's rejected as anFirebaseAuthError
with theAuthClientErrorCode.INVALID_ARGUMENT
error code.Would it be possible to to add something like
AuthClientErrorCode.TOKEN_EXPIRED
or expose the originalerror.name
aserror.errorInfo.name
?I'd be glad to contribute a PR for any of the above propsals.
The text was updated successfully, but these errors were encountered: