Android Studio: I am always logged in, although there are no users in my firebase and I check this with a function. Why?

Question

I write a code in which checks whether the user already exists and he does not log in again (would be annoying). I added this code to my LoginActivity because it would then have to jump into the AppStartActivity (the activity after logging in or registering) if it has already registered and logged in. However, I delete the user from the Firebase database and when I start the app again at the emulator, I am still in the AppStartActivity, although no account exists in the database, since I've deleted it. Why does this happen?

i check it if the user exists:

mAuthStateListener = new FirebaseAuth.AuthStateListener() {
            @Override
            public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {

                FirebaseUser user = firebaseAuth.getCurrentUser();

                if (user != null) {
                    Intent switchToAppStartActivity = new Intent(getApplicationContext(), AppStartActivity.class);
                    startActivity(switchToAppStartActivity);
                }
            }
        };

but i delete all the users in firebase and still i switch to the Activity after the Login or Registration when i start the app on emulator. Why?

This is the whole code:

import android.content.Intent;
import android.support.annotation.NonNull;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.EditText;

import com.google.firebase.auth.FirebaseAuth;
import com.google.firebase.auth.FirebaseUser;

public class LoginActivity extends AppCompatActivity {

    EditText emailLogin;
    EditText passwordLogin;

    private FirebaseAuth mAuth;
    private FirebaseAuth.AuthStateListener mAuthStateListener;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_login);

        emailLogin = (EditText) findViewById(R.id.emailLogin);
        passwordLogin = (EditText) findViewById(R.id.passwordLogin);

        mAuthStateListener = new FirebaseAuth.AuthStateListener() {
            @Override
            public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {

                FirebaseUser user = firebaseAuth.getCurrentUser();

                if (user != null) {
                    Intent switchToAppStartActivity = new Intent(getApplicationContext(), AppStartActivity.class);
                    startActivity(switchToAppStartActivity);
                }
            }
        };

    }

        public void setupNewAccount (View view){
        Intent registrationActivity = new Intent(getApplicationContext(), EmailSignUpActivity.class);
        startActivity(registrationActivity);

    }
}

How long did you wait after deleting the user from the console? Firebase Authentication uses ID tokens, which are valid for an hour after they are minted. It is normal that the user stays signed in until their ID token needs to be refreshed. — Frank van Puffelen, Jan 24 '19 at 04:34
really? maybe i wait 2 minutes... i tought it happens in realtime? oh ok thanks for the information... — Tolga, Jan 24 '19 at 05:02

score 0 · Accepted Answer · answered Jan 24 '19 at 05:20

Firebase Authentication uses ID tokens, which are valid for an hour after they are minted. This prevents the need to revalidate the token on ever call, and significantly improves performance. But it does mean that it is normal that the user stays signed in until their ID token needs to be refreshed.

If you need to lock a user out of the app, you should probably implement a blacklisting mechanism, where you store their UID in a list of known bad users. This also prevents them from simply reregistering again to regain access.

Also see:

now i wait more than 1 hour but if i start the emulator i am still in the activity after the login or register. — Tolga, Jan 24 '19 at 13:56
If the account was deleted, it can't refresh the ID token. So if you're still seeing the deleted user as signed in, something else must be going on. — Frank van Puffelen, Jan 24 '19 at 13:59

Android Studio: I am always logged in, although there are no users in my firebase and I check this with a function. Why?

1 Answers1