Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[firebase_auth]: authStateChanges() never emits null when the user is force-signed-out before the stream is listened to (iOS, macOS, Android)

Aperta
  • Qualcosa non va?
#18,796 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@JulianPscheid ci sta già lavorando.

Dal 13/10/2026.

  • #18797 di @JulianPscheid — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
android, dart, ios, kotlin, macos, swift
Ambito
authentication, mobile

Direzione di ricerca

Work is already in progress: pull request #18797 is open against this issue, so review or build on it rather than starting a parallel fix. The first-callback handling lives in FLTAuthStateChannelStreamHandler.swift and FLTIdTokenChannelStreamHandler.swift (iOS and macOS) and in AuthStateChannelStreamHandler.kt and IdTokenChannelStreamHandler.kt (Android), with the Dart side in the auth state handlers. Done means a null first callback reaches Dart, a normal signed-in launch is unchanged, and the 'fires once on first initialization' test still passes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Needs Attention platform: android platform: ios platform: macos plugin: auth reproduced type: bug

Is there an existing issue for this? I have searched the existing issues. #10230 is related, but it covers a running app with no token refresh.

Which plugins are affected? Auth

Which platforms are affected? Android, iOS, macOS

Description

If Firebase Auth signs the user out on its own before the app listens to authStateChanges() or idTokenChanges(), the Dart side never finds out. FirebaseAuth.instance.currentUser keeps returning the old user for the rest of the process, and all three streams keep emitting that user. Calls that need a token fail with [firebase_auth/no-current-user], Firestore rejects every request with permission-denied, and the app stays on its signed-in UI.

The usual trigger is a revoked refresh token, for example after a password change on another device or an Admin SDK revokeRefreshTokens() call. On the next cold start after the cached ID token has expired, the first token refresh fails and the native SDK signs the user out (on Apple it logs [FirebaseAuth][I-AUT000016] Invalid user token detected, user is automatically signed out.). In our app that happened 1 to 5 seconds after launch, which can be before the first authStateChanges() subscription exists.

The Apple and Android stream handlers drop the first native listener callback unconditionally, because Dart already has an initial value (APP_CURRENT_USER from the plugin constants). You can see it in FLTAuthStateChannelStreamHandler.swift and FLTIdTokenChannelStreamHandler.swift (iOS and macOS) and in AuthStateChannelStreamHandler.kt / IdTokenChannelStreamHandler.kt (Android), where initialAuthState makes the first callback return early. If the native user is already nil when the listener is registered, that first callback is the sign-out, and it gets dropped. On Apple no second nil follows, because addStateDidChangeListener only forwards uid changes. Calling signOut() from Dart afterwards doesn't fix it: the native SDK is already signed out, returns early, and sends no event.

This also breaks signing back in. After the user signs out manually and signs in again with the same account, Dart still holds that user, so apps that react to a change of user see nothing new, and navigation after sign-in can stall until the app is restarted.

Windows (firebase_auth_plugin.cpp) and web forward every callback and aren't affected.

Proposed fix: keep dropping the first callback when it carries a user, and forward it when the user is nil. On its own that would give a fresh signed-out app a second null event, which is what the "fires once on first initialization" test guards against (#3628), so the Dart handlers should also skip a null event when currentUser is already null. A normal signed-in launch behaves as before. I'll open a PR with both changes.

Reproducing the issue
  1. Sign in with email/password on macOS, iOS or Android, then quit the app.
  2. Revoke the user's refresh tokens (Admin SDK revokeRefreshTokens(uid), or change the password from another client).
  3. Wait at least an hour so the cached ID token expires.
  4. Launch the app and subscribe to FirebaseAuth.instance.authStateChanges() a few seconds after startup, or after any early call that refreshes the token, such as currentUser!.getIdTokenResult() or a Firestore read.
  5. Expected: the stream emits null and currentUser is null. Actual: the stream emits the old user, currentUser stays non-null, token-dependent calls fail, and the native log shows the automatic sign-out.

We reproduced this on macOS with firebase_auth 6.7.0. With the proposed change, the app gets null and routes to sign-in, and signing in again works without a restart.

Firebase Core version: 4.15.0 (firebase_auth 6.7.0, firebase-ios-sdk 12.19.0, Android firebase-auth 24.2.0)

Flutter Version: 3.44.8 stable

Relevant Log Output
[FirebaseAuth][I-AUT000016] Invalid user token detected, user is automatically signed out.
[FirebaseFirestore][I-FST000001] Listen for query at users/<uid> failed: Missing or insufficient permissions.
FirebaseAuthException: [firebase_auth/no-current-user] No user currently signed in.
Lingua principale
Dart
Stelle
9.3k
Fork
4.1k
Merge medio
2g 8h
PR unite (30g)
46

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di firebase/flutterfire

Tutte le issue di firebase/flutterfire

Issue simili

Altre issue su Dart

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.