4

Here is the situation, I'm using firebase authentication with federal providers and email. When an user logs in success, is saved in firebase realtime database. That works perfectly. The problem that I'm having is the following:

  • An user logs in in the application starting a new session and then go out without close that session.
  • I delete that user from firebase authentication console.
  • The user opens again the application, there is a firebase session active with that user id but this id doesn't exists anymore in the console.

So, in that case, when I call a method to find the user by id in database, the onDataChange is never been called.

Here is the AuthStateListener code:

this.mAuthListener = new FirebaseAuth.AuthStateListener() {
        @Override
        public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {

            if (firebaseAuth.getCurrentUser() != null) {

                //There is an active session with an user id but the user doesn't exist anymore in Firebase Authentication console

                FBAuthManager.this.mAuthCurrentUser = firebaseAuth.getCurrentUser();

                AppUtils.writeLog("User to find: " + firebaseAuth.getCurrentUser().getUid());

                databaseManager.getUserById(firebaseAuth.getCurrentUser(), true, listener);

            } else
                listener.onFailedToCompleteTask("user is null");

        }
    };

This is the getUserById method:

public void getUserById(@NonNull String user_id, boolean single_value, @NonNull final DAOManagerListener.OnGetUserListener listener){

    checkingDatabaseConnection();

    ValueEventListener valueEventListener = new ValueEventListener() {
        @Override
        public void onDataChange(DataSnapshot dataSnapshot) {

            //It 's never been called when the user id doesn't exist in the Firebase Authentication console

            if ( dataSnapshot.exists()) {

                UserChat userChat = dataSnapshot.getValue(UserChat.class);

                listener.onGetUser(userChat);
            }
            else
                listener.onFailedToGetUser("user doesn't exist");
        }

        @Override
        public void onCancelled(DatabaseError databaseError) {

            listener.onFailedToGetUser( databaseError.getMessage() );
        }
    };

    if ( single_value )
        this.mDatabaseReference.child(USERS_CHILD).child(user_id).addListenerForSingleValueEvent(valueEventListener);
    else
        this.mDatabaseReference.child(USERS_CHILD).child(user_id).addValueEventListener(valueEventListener);

}

The checkingDatabaseConnection method indicates that the database is not connected

DatabaseReference connectedRef = FirebaseDatabase.getInstance().getReference(".info/connected");
        connectedRef.addValueEventListener(new ValueEventListener() {
            @Override
            public void onDataChange(DataSnapshot snapshot) {
                boolean connected = snapshot.getValue(Boolean.class);
                if (connected) {
                    AppUtils.writeLog("connected");
                } else {
                    AppUtils.writeLog("not connected");
                }
            }

            @Override
            public void onCancelled(DatabaseError error) {
                AppUtils.writeLog("Listener was cancelled");
            }
        });

My firebase rules are setted to read and write only if the user is authenticated.

I don't know if I can check if an user that has an active firebase session in the app exists in the firebase console.

I hope had explain myself. If you need more information please let me know it.

Vadim Kotov
  • 8,084
  • 8
  • 48
  • 62
AlphaDeveloper
  • 539
  • 8
  • 23
  • 1
    Deleting an account on the server does not automatically invalidate the sessions of that account on the client. See http://stackoverflow.com/questions/35960546/firebase-still-retrieving-authdata-after-deletion/35961217#35961217 and http://stackoverflow.com/questions/38345085/firebase-authentication-state-change-does-not-fire-when-user-is-disabled-or-dele/38354484#38354484. The user will after some time (at most an hour iirc) be unable to refresh their access token. But until that happens, they'll still be an authenticated user. If you want to lock them out, see the links. – Frank van Puffelen Apr 24 '17 at 15:35

0 Answers0