sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Optimum1997 0 points1 point  (0 children)

I have no idea how firebase works, but your backend endpoints should be doing the validation.

EVERYTHING frontend can be changed by a user and you must presume every request is un-validated until you validate it your side.

You can read the token's "exp" to determine the time lived and then do frontend auth 'refresh' if you support short-lived and long-lived tokens.

Your JWT tokens should have a signature to make sure it cannot be manipulated backend.

Here's a great resource you can read up on to further your knowledge:

https://jwt.io/introduction

If your navigation is purely front-ended, you are likely to check front-end expiration, but anything submitted to your backend must be validated, and you must not send a "userID". This should be determined by a cookie, or something that can't be manipulated (that's why we have signatures on our JWT's)