Multiple concurrent token refresh calls on app launch

[thibaudse]

Description

Hello Firebase team,

We’re encountering an issue where the Firebase SDK triggers multiple concurrent token refresh calls on app launch.

Summary

We’re encountering an issue where the Firebase SDK triggers 11 concurrent calls to the token refresh endpoint on app launch. This appears to be related to the 11 concurrent Firebase SDK calls we make during initialization.

We suspect a race condition or concurrency issue within the Firebase SDK where multiple requests try to refresh the same token simultaneously when it’s invalid or expired.

Expected Behavior

The SDK should detect that a token refresh is already in progress and queue or await the same refresh promise instead of triggering multiple concurrent calls.

Actual Behavior

• Multiple simultaneous refresh token requests are triggered.
• This causes:
  • Quota exhaustion on the Firebase token refresh endpoint.
  • Some users being signed out unexpectedly, likely due to tokens being replaced or mismatched during concurrent refreshes.
• We’ve observed this affecting ~15% of our users today (millions of MAUs).

Evidence

We’ve attached a Proxyman screenshot showing 11 concurrent refresh calls happening within the same timestamp window.

Impact

• User sign-outs and degraded session stability.
• Increased API quota consumption.
• Difficult to reliably reproduce or intercept due to concurrency nature.

Reproducing the issue

It’s difficult to reproduce consistently, but the general flow is:

1. Initialize Firebase SDK on app launch.
2. Make several concurrent calls to Firebase (Firestore, Auth, etc.).
3. If the user’s token is invalid, each call triggers a token refresh.
4. The SDK fires multiple concurrent refresh token requests instead of handling the refresh synchronously.

Firebase SDK Version

12.3.0

Xcode Version

26.1

Installation Method

Swift Package Manager

Firebase Product(s)

Authentication

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

No response

If using CocoaPods, the project's Podfile.lock

No response

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[rizafran]

Thanks for the report, @thibaudse. Could you share a sample app that reproduces the issue? I believe you can implement a mechanism to detect that the token refresh is already in progress (like using an actor or dispatch queue), to ensure that only one token refresh occurs at a time.

[thibaudse]

Hey @rizafran, thanks for getting back to me!
I’ve just uploaded a sample app that reproduces the issue, with clear instructions in the README.
Let me know if you need anything else.

Here’s the repo: https://github.com/thibaudse/firebase-concurrency-issue-mcve

[thibaudse]

Hi @rizafran, just a quick update: we’ve forked the repository and implemented a fix to handle concurrent refresh token requests. I’ll follow up here once the PR is ready and open.

Edit:
Here is the PR that includes the fix we implemented: #15493