Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[firebase_auth]: authStateChanges() never emits null when the user is force-signed-out before the stream is listened to (iOS, macOS, Android)

Abierto
  • ¿Algo no está bien?
#18,796 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@JulianPscheid ya está trabajando en esto.

Desde el 13/10/2026.

  • #18797 de @JulianPscheid — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
android, dart, ios, kotlin, macos, swift
Área
authentication, mobile

Línea de trabajo

Work is already in progress: pull request #18797 is open against this issue, so review or build on it rather than starting a parallel fix. The first-callback handling lives in FLTAuthStateChannelStreamHandler.swift and FLTIdTokenChannelStreamHandler.swift (iOS and macOS) and in AuthStateChannelStreamHandler.kt and IdTokenChannelStreamHandler.kt (Android), with the Dart side in the auth state handlers. Done means a null first callback reaches Dart, a normal signed-in launch is unchanged, and the 'fires once on first initialization' test still passes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Needs Attention platform: android platform: ios platform: macos plugin: auth type: bug

Is there an existing issue for this? I have searched the existing issues. #10230 is related, but it covers a running app with no token refresh.

Which plugins are affected? Auth

Which platforms are affected? Android, iOS, macOS

Description

If Firebase Auth signs the user out on its own before the app listens to authStateChanges() or idTokenChanges(), the Dart side never finds out. FirebaseAuth.instance.currentUser keeps returning the old user for the rest of the process, and all three streams keep emitting that user. Calls that need a token fail with [firebase_auth/no-current-user], Firestore rejects every request with permission-denied, and the app stays on its signed-in UI.

The usual trigger is a revoked refresh token, for example after a password change on another device or an Admin SDK revokeRefreshTokens() call. On the next cold start after the cached ID token has expired, the first token refresh fails and the native SDK signs the user out (on Apple it logs [FirebaseAuth][I-AUT000016] Invalid user token detected, user is automatically signed out.). In our app that happened 1 to 5 seconds after launch, which can be before the first authStateChanges() subscription exists.

The Apple and Android stream handlers drop the first native listener callback unconditionally, because Dart already has an initial value (APP_CURRENT_USER from the plugin constants). You can see it in FLTAuthStateChannelStreamHandler.swift and FLTIdTokenChannelStreamHandler.swift (iOS and macOS) and in AuthStateChannelStreamHandler.kt / IdTokenChannelStreamHandler.kt (Android), where initialAuthState makes the first callback return early. If the native user is already nil when the listener is registered, that first callback is the sign-out, and it gets dropped. On Apple no second nil follows, because addStateDidChangeListener only forwards uid changes. Calling signOut() from Dart afterwards doesn't fix it: the native SDK is already signed out, returns early, and sends no event.

This also breaks signing back in. After the user signs out manually and signs in again with the same account, Dart still holds that user, so apps that react to a change of user see nothing new, and navigation after sign-in can stall until the app is restarted.

Windows (firebase_auth_plugin.cpp) and web forward every callback and aren't affected.

Proposed fix: keep dropping the first callback when it carries a user, and forward it when the user is nil. On its own that would give a fresh signed-out app a second null event, which is what the "fires once on first initialization" test guards against (#3628), so the Dart handlers should also skip a null event when currentUser is already null. A normal signed-in launch behaves as before. I'll open a PR with both changes.

Reproducing the issue
  1. Sign in with email/password on macOS, iOS or Android, then quit the app.
  2. Revoke the user's refresh tokens (Admin SDK revokeRefreshTokens(uid), or change the password from another client).
  3. Wait at least an hour so the cached ID token expires.
  4. Launch the app and subscribe to FirebaseAuth.instance.authStateChanges() a few seconds after startup, or after any early call that refreshes the token, such as currentUser!.getIdTokenResult() or a Firestore read.
  5. Expected: the stream emits null and currentUser is null. Actual: the stream emits the old user, currentUser stays non-null, token-dependent calls fail, and the native log shows the automatic sign-out.

We reproduced this on macOS with firebase_auth 6.7.0. With the proposed change, the app gets null and routes to sign-in, and signing in again works without a restart.

Firebase Core version: 4.15.0 (firebase_auth 6.7.0, firebase-ios-sdk 12.19.0, Android firebase-auth 24.2.0)

Flutter Version: 3.44.8 stable

Relevant Log Output
[FirebaseAuth][I-AUT000016] Invalid user token detected, user is automatically signed out.
[FirebaseFirestore][I-FST000001] Listen for query at users/<uid> failed: Missing or insufficient permissions.
FirebaseAuthException: [firebase_auth/no-current-user] No user currently signed in.
Lenguaje dominante
Dart
Estrellas
9.3k
Forks
4.1k
Merge medio
2 d 2 h
PR fusionados (30 d)
41

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de firebase/flutterfire

Todos los issues de firebase/flutterfire

Issues similares

Más issues de Dart

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.