Firestore + Auth emulators -> INVALID_REFRESH_TOKEN

[hellfenix]

Environment

• Android Studio version: 2020.3.1 Beta 3
• Firebase Component: Firestore + Auth emulators
• Component version: Firestore version 23.0.1 // Firebase-Auth version 21.0.1
• Running on macOS 10.15.7
• firebase CLI version 9.12.1

Problem

After a while, around 60 minutes (token expiration time) Firestore is unable to properly authenticate when using local emulators for both Firestore and Firebase-Auth.

Expected behaviour:

The token should be automatically refreshed and access to Firestore should be allowed.

Steps to reproduce:

1. Run firestore + auth emulators (optionally enable security rules to allow authenticated queries)
2. Set up an android project and call 'useEmulator' methods on both FirebaseFirestore and AuthUI pointing to "10.0.2.2:8080" and "10.0.2.2:9099" (see settings on the next section)
3. Use FirebaseUI to handle login
4. On the main activity just trigger any method that uses Firestore
5. After a successful connection, kill the app and wait for the token to expire (without closing the emulators)
6. Open the app again and do not manually reauthenticate, just check FirebaseAuth.currentUser != null and verify that it's not null (which will be if step 3 succeeded), wait for the main activity to load and Firestore will throw an error and fail to connect due to INVALID_REFRESH_TOKEN

Relevant Code:

Firestore settings:

val firestore = FirebaseFirestore.getInstance()
firestore.useEmulator("10.0.2.2", 8080)

val settings = FirebaseFirestoreSettings.Builder()
                .setPersistenceEnabled(false)
                .build()
firestore.firestoreSettings = settings

Firebase Auth / UI settings:

AuthUI.getInstance().useEmulator("10.0.2.2", 9099)
val providers = arrayListOf(
           AuthUI.IdpConfig.EmailBuilder().build(),
           AuthUI.IdpConfig.GoogleBuilder().build())

       launcher.launch(
           AuthUI.getInstance()
           .createSignInIntentBuilder()
           .setIsSmartLockEnabled(false)
           .setAvailableProviders(providers)
           .build())

This is the exception thrown:

W/Firestore: (23.0.1) [FirestoreCallCredentials]: Failed to get token: com.google.firebase.FirebaseException: An internal error has occurred. [ INVALID_REFRESH_TOKEN ].
W/Firestore: (23.0.1) [WatchStream]: (1a1b32e) Stream closed with status: Status{code=UNAUTHENTICATED, description=null, cause=com.google.firebase.FirebaseException: An internal error has occurred. [ INVALID_REFRESH_TOKEN ]
        at com.google.android.gms.internal.firebase-auth-api.zzto.zza(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zzuw.zza(com.google.firebase:firebase-auth@@21.0.1:9)
        at com.google.android.gms.internal.firebase-auth-api.zzux.zzl(com.google.firebase:firebase-auth@@21.0.1:1)
        at com.google.android.gms.internal.firebase-auth-api.zzuu.zzk(com.google.firebase:firebase-auth@@21.0.1:25)
        at com.google.android.gms.internal.firebase-auth-api.zztl.zzh(com.google.firebase:firebase-auth@@21.0.1:1)
        at com.google.android.gms.internal.firebase-auth-api.zzom.zza(com.google.firebase:firebase-auth@@21.0.1:2)
        at com.google.android.gms.internal.firebase-auth-api.zzvb.zza(com.google.firebase:firebase-auth@@21.0.1:23)
        at com.google.android.gms.internal.firebase-auth-api.zzul.zzf(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zzpt.zzp(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zztp.zzk(com.google.firebase:firebase-auth@@21.0.1:5)
        at com.google.android.gms.internal.firebase-auth-api.zzqr.zzd(com.google.firebase:firebase-auth@@21.0.1:3)
        at com.google.android.gms.internal.firebase-auth-api.zzqq.accept(Unknown Source:6)
        at com.google.android.gms.common.api.internal.zacj.doExecute(com.google.android.gms:play-services-base@@17.1.0:2)
        at com.google.android.gms.common.api.internal.zaf.zac(com.google.android.gms:play-services-base@@17.1.0:6)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zac(com.google.android.gms:play-services-base@@17.1.0:167)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zab(com.google.android.gms:play-services-base@@17.1.0:139)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zaa(com.google.android.gms:play-services-base@@17.1.0:105)
        at com.google.android.gms.common.api.internal.GoogleApiManager.handleMessage(com.google.android.gms:play-services-base@@17.1.0:145)
        at android.os.Handler.dispatchMessage(Handler.java:102)
        at com.google.android.gms.internal.base.zar.dispatchMessage(com.google.android.gms:play-services-base@@17.1.0:8)
        at android.os.Looper.loop(Looper.java:193)
        at android.os.HandlerThread.run(HandlerThread.java:65)
    }.
    (23.0.1) [OnlineStateTracker]: Could not reach Cloud Firestore backend. Connection failed 1 times. Most recent error: Status{code=UNAUTHENTICATED, description=null, cause=com.google.firebase.FirebaseException: An internal error has occurred. [ INVALID_REFRESH_TOKEN ]
        at com.google.android.gms.internal.firebase-auth-api.zzto.zza(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zzuw.zza(com.google.firebase:firebase-auth@@21.0.1:9)
        at com.google.android.gms.internal.firebase-auth-api.zzux.zzl(com.google.firebase:firebase-auth@@21.0.1:1)
        at com.google.android.gms.internal.firebase-auth-api.zzuu.zzk(com.google.firebase:firebase-auth@@21.0.1:25)
        at com.google.android.gms.internal.firebase-auth-api.zztl.zzh(com.google.firebase:firebase-auth@@21.0.1:1)
        at com.google.android.gms.internal.firebase-auth-api.zzom.zza(com.google.firebase:firebase-auth@@21.0.1:2)
        at com.google.android.gms.internal.firebase-auth-api.zzvb.zza(com.google.firebase:firebase-auth@@21.0.1:23)
        at com.google.android.gms.internal.firebase-auth-api.zzul.zzf(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zzpt.zzp(com.google.firebase:firebase-auth@@21.0.1:4)
        at com.google.android.gms.internal.firebase-auth-api.zztp.zzk(com.google.firebase:firebase-auth@@21.0.1:5)
        at com.google.android.gms.internal.firebase-auth-api.zzqr.zzd(com.google.firebase:firebase-auth@@21.0.1:3)
        at com.google.android.gms.internal.firebase-auth-api.zzqq.accept(Unknown Source:6)
        at com.google.android.gms.common.api.internal.zacj.doExecute(com.google.android.gms:play-services-base@@17.1.0:2)
        at com.google.android.gms.common.api.internal.zaf.zac(com.google.android.gms:play-services-base@@17.1.0:6)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zac(com.google.android.gms:play-services-base@@17.1.0:167)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zab(com.google.android.gms:play-services-base@@17.1.0:139)
        at com.google.android.gms.common.api.internal.GoogleApiManager$zaa.zaa(com.google.android.gms:play-services-base@@17.1.0:105)
        at com.google.android.gms.common.api.internal.GoogleApiManager.handleMessage(com.google.android.gms:play-services-base@@17.1.0:145)
        at android.os.Handler.dispatchMessage(Handler.java:102)
        at com.google.android.gms.internal.base.zar.dispatchMessage(com.google.android.gms:play-services-base@@17.1.0:8)
        at android.os.Looper.loop(Looper.java:193)
        at android.os.HandlerThread.run(HandlerThread.java:65)
    }
    This typically indicates that your device does not have a healthy Internet connection at the moment. The client will operate in offline mode until it is able to successfully connect to the backend.
W/System: Ignoring header X-Firebase-Locale because its value was null.

[malcolmdeck]

Hey there, Malcolm from Firebase here. I've filed b/191059913 to track this internally. Once I figure out what's going on, I'll get back to you :)

[ronba]

Hey @malcolmdeck - are there any updates on b/191059913 you could share?
For now I just added an exception handler and I force a logout followed by a login when that exception is thrown.

[ronba]

@malcolmdeck just a very gentle bump on this :)
For now we stopped using the auth emulator as even with the exception handler the behaviour was too unpredictable.

[vharron]

I was able to reproduce this. I think it was caused by restarting the emulator without importing the user that the client was depending on. Not a huge surprise that auth started failing.