Deleted user has access to Firebase Firestore

Question

My application is a company-internal software. I want to enable all authenticated users to access all documents in the Firestore for tests. I ran into a mistake while doing this.

1. The user logs in to the iOS app and has access to the documents.
2. I delete the user from Firebase Auth (via Firebase console) As long as the user has the app open, he receives updates and can read and write.

Here is the code from the rules:

  rules_version = '2';
  service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read : if request.auth != null
      allow write: if request.auth != null
    }
  }
}

How can I prevent deleted users from continuing to have access?

Answer 1

1. The user logs in to the iOS app and has access to the documents.

That's the expected behavior.

2. I delete the user from Firebase Auth (via the console) As long as the user has the app open, he receives updates and can read and write.

When a user signs in with Firebase, he receives a token that is valid for about an hour. Unfortunately, such a token cannot be revoked, due to expensive checks on each call.

If you delete a user account right from the Firebase Console, the user can still have access for up to an hour. After that period of time, the token needs to be refreshed. But this operation will fail since that account doesn't exist anymore. So that access will automatically be disabled within an hour.

However, if you want to remove that access before the token expires, then you should consider keeping an additional list of banned UIDs and maintaining it over time. For instance, you can keep a global list/array of bannedUIDs into a document, and add the UID to that. Lastly, in your security rules, you can check if that particular UID is not banned. If that UID exists inside that list, then Firebase servers will reject the operation.

Edit:

Another option might be to disable the user account. This accomplishes the same as above and the user won't be able to get a new token after the current token expires. It also prevents the user from signing up again with the same credentials.