Authenticated as a user after logging out and reinstalling

• Android device: Moto E3
• Android OS version: 6.0
• Google Play Services version: 10.2.1
• Firebase/Play Services SDK version: 10.2.1
• FirebaseUI version: 1.2.0

The problem:

Steps to reproduce:

1. On logging in with facebook
2. logging out with the following (verifying it works and CompleteListener is called)

AuthUI.getInstance()
                .signOut(this)
                .addOnCompleteListener(task -> {
                    if (task.isSuccessful()) {
                        finish();
                    } else {
                        Toast.makeText(this, R.string.sign_out_failed, Toast.LENGTH_LONG).show();
                    }
                });

1. Uninstalling and reinstalling
2. On launch, the first thing I do is call FirebaseAuth.getInstance().getCurrentUser() which returns the user that I had logged out before reinstalling
3. Additionally: If I retry these steps, and instead of uninstall/reinstall in step 3, I just kill the app and relaunch, I’m getting null for FirebaseAuth.getInstance().getCurrentUser()

NOTE: I’m also allowing backup in my manifest with android:allowBackup="true"

• It appears to not happen if I set android:allowBackup="false" although I haven’t tested this extensively enough to be 100%.

Expected Results:

• After logging out, having no other way to get the current user without first logging back in

[samtstern]

@ahaverty so I can’t say I know what Facebook is storing locally on the phone, but I can tell you what Firebase is storing.

Firebase keeps an authentication token in your app’s local storage. This identifies the user but does not give them access to actually do anything unless it’s refreshed every hour. The Firebase SDKs that use this token (like realtime database) seamlessly handle this refresh for you which is why you don’t have to think about it. If you attach an AuthStateListener in your app you’ll see that you get a new event every hour as the token changes.

So there’s no security risk of restoring this token, since auto backup is linked to the user’s google account anyway. This would be different if we were storing, say, a Google Sign In access_token which could be taken out of context and used to impersonate the user.

[SUPERCILEX]

@ahaverty Noooooooooooooo! 😁 Please don’t disable auto backup; this “bug” is a feature that’s great UX. The idea is that if a user is changing devices or reinstalling your app for one reason or another, they can get right back to whatever they were doing instead of having to go through​ some long and annoying setup. Hope this swayed your opinion a little! 😁