Skip to content

fix(auth): log out before Facebook sign-in to clear stale cached token#2322

Merged
russellwheatley merged 4 commits into
version-10.0.0-beta03from
fix/facebook-stale-token
May 18, 2026
Merged

fix(auth): log out before Facebook sign-in to clear stale cached token#2322
russellwheatley merged 4 commits into
version-10.0.0-beta03from
fix/facebook-stale-token

Conversation

@demolaf
Copy link
Copy Markdown
Member

@demolaf demolaf commented May 15, 2026

Closes #879

When a user switches accounts in the native Facebook app without signing out of FirebaseUI, the Facebook SDK retains a stale cached token. On the next sign-in attempt this caused a silent failure with "User logged in as different Facebook user".

Calling logOut() at the start of signInWithFacebook clears the local token cache before each sign-in, forcing a fresh authentication.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds a logOut() call to the Facebook sign-in flow to prevent stale token issues and includes a unit test for verification. The reviewer identified that the current placement of the logOut() call is likely too late to affect the current sign-in attempt and should be moved to the launcher. Furthermore, there is an inconsistency in the use of the login manager provider that should be addressed to ensure correct behavior when using test overrides.

@demolaf demolaf requested a review from russellwheatley May 15, 2026 11:45
@russellwheatley
Copy link
Copy Markdown
Member

@demolaf - I've made some updates:

  • Wrapped pre-sign-in Facebook logOut() in try/catch so a logout failure cannot strand the user in Loading or block the sign-in launcher.
  • Logged that swallowed logout failure as a warning because sign-in still proceeds.
  • Added a regression test covering a throwing stale-token logout path, ensuring that specific logout exception is not propagated.
  • Updated KDoc for the new loginManagerProvider parameter so its purpose is clear.

@russellwheatley russellwheatley merged commit 28bbb09 into version-10.0.0-beta03 May 18, 2026
10 checks passed
@russellwheatley russellwheatley deleted the fix/facebook-stale-token branch May 18, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants