Why FirebaseAuth.IdTokenChanged invokes 2 times on login?

Question

I am working on app development with a strong custom backend part where each API request call contain Firebase auth token in a header. In a testing process we realised that token always received twice.

I used same logic as described in a Firebase sample project. To be sure it's not my mistake I check clean sample project, and result is still the same - somehow OnIdTokenChanged called twice on login. Both callbacks contain correct token. I am on Unity 2018.3.5f1, .NET 4.5, and Firebase SDK v.5.4.4

Here is some code sample:

public virtual void Start() {
  Firebase.FirebaseApp.CheckAndFixDependenciesAsync().ContinueWith(task => {
    dependencyStatus = task.Result;
    if (dependencyStatus == Firebase.DependencyStatus.Available) {
      InitializeFirebase();
    } else {
      Debug.LogError(
        "Could not resolve all Firebase dependencies: " + dependencyStatus);
    }
  });
}

protected void InitializeFirebase() {
  DebugLog("Setting up Firebase Auth");
  auth = Firebase.Auth.FirebaseAuth.DefaultInstance;
  auth.StateChanged += AuthStateChanged;
  auth.IdTokenChanged += IdTokenChanged;
}

void IdTokenChanged(object sender, System.EventArgs eventArgs) {
  Firebase.Auth.FirebaseAuth senderAuth = sender as Firebase.Auth.FirebaseAuth;
  if (senderAuth == auth && senderAuth.CurrentUser != null && !fetchingToken) {
    senderAuth.CurrentUser.TokenAsync(false).ContinueWith(
      // THIS CALLED TWICE
      task => DebugLog(String.Format("Token = {0}", task.Result)));
  }
}

Some important app logic is based on a token receive event which should be received only once, and it's completely incorrect to get 2 token for 1 login.

Is it a bug or expected behaviour? If bug, does same behaviour exists on other platforms, like iOS/Android native or it's just Unity3d problem?

Answer 1

I'd expect the first invocation to happen right after you attach the listener, in which case it's the local token as taken from the application's cache. The second time is after the client has verified with the server that the token is still valid, or has refreshed the ID token.

From the documentation on the IDTokenChanged event:

Authentication ID token changes are:

• When a user signs in
• When the current user signs out
• When the current user changes
• When there is a change in the current user's token