Why is a new token generated for each request?

[ereyes01]

    def _authenticate(self, params, headers):
        """
        Method that simply adjusts authentication credentials for the
        request.
        `params` is the querystring of the request.
        `headers` is the header of the request.
        If auth instance is not provided to this class, this method simply
        returns without doing anything.
        """
        if self.authentication:
            user = self.authentication.get_user()
            params.update({'auth': user.firebase_auth_token})
            headers.update(self.authentication.authenticator.HEADERS)

The _authenticate method is invoked for each request. Each time self.authentication.get_user() is invoked, a new JWT token is built:

    def get_user(self):
        """
        Method that gets the authenticated user. The returning user has
        the token, email and the provider data.
        """
        token = self.authenticator.create_token(self.extra)  # creates new JWT
        user_id = self.extra.get('id')
        return FirebaseUser(self.email, token, self.provider, user_id)

Why is a new token built for each request? It seems to me like the sensible thing to do would be to build a token in the constructor of FirebaseAuthentication, and stash it in the authenticator object? The caller should be able to specify when this token expires.

[lgozalvez]

Hi, @ereyes01 I'm experiencing high downloads rates on Firebase because this issue I think...

Did you find any solution?

[ereyes01]

Sorry, I haven't thought about or looked at this for years. I would recommend you start with Firebase's official bindings and their docs. Best of luck!

[lgozalvez]

Hey, no worries. We just hired a guy and he is doing a great work

Thanks again for all your work

Just for your info.

Why your repo is important?: I’m using an IOT device with very little free disk space (2-3MB). Your library is one of the lightest one

Ex: Firebase official python SDK is 40 mb

Best

On 2 Jun 2020, at 17:18, Eddy Reyes [email protected] wrote:

Sorry, I haven't thought about or looked at this for years. I would recommend you start with Firebase's official bindings and their docs. Best of luck!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/ozgur/python-firebase/issues/29#issuecomment-637609809, or unsubscribe https://github.com/notifications/unsubscribe-auth/AC5BSPG2SO6BHW3BK2WZ7X3RUUJ3ZANCNFSM4AX437PQ.

[ereyes01]

This isn't my repo, I was just a dude trying to figure out how to use it back in 2014 :-) My guess is that you're right and it's not necessary anymore.

I do have this one for Go: https://github.com/ereyes01/firebase

It still is being used in production code, so it's pretty stable. However, there may now be an official Go client for Firebase, so maybe mine isn't necessary either :shrug: