# Why do my Firebase users keep getting logged out?
> Users of your Firebase app keep getting logged out or see the login screen again. What really ends a Firebase session, and the app settings that cause it.
Canonical: https://app369.com/fix/firebase-users-keep-getting-logged-out/
Last updated: 2026-11-12
Users sign in, come back later and land on the login screen again. Some get logged out when they close the tab, some after about an hour, some when they visit another version of your web address. Firebase keeps users signed in for a long time by default, so look at how the app is set up first. Here’s what Firebase’s docs say, in their words, and what to check, or hand it over at a fixed price.
**Rather hand it over?** [App Fix Ticket](https://app369.com/fixed-price/flutter-firebase-bug-fix/): One reproducible bug in an existing mobile or web app, diagnosed and fixed.
[Pay $450 for a Diagnosis](https://buy.stripe.com/dRmdRa7K4bWz8CWdwagw003) [**Ask a question first**](https://app369.com/contact/?offer=offer1-diagnosis&ask=1)
Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts. [Refund terms](https://app369.com/terms-of-service/#refunds).
- Simon does the work himself
- [5.0 from 127 Fiverr reviews, checked Oct 30, 2026](https://app369.com/reviews/)
**Short answer**
Firebase sessions are long lived: refresh tokens expire only when the user is deleted or disabled, or after a major account change such as a new password or email address. If users drop at other times, check how the web app stores the session (local, session or none), whether users switch between domains, whether the app reads the current user before Firebase has loaded it, and whether a server keeps the one-hour ID token without refreshing it.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why users get logged out, and the fix**
1. 01 ### **The web app keeps the session only for the tab**
> “will be cleared when the tab or window in which the user authenticated is closed” [**Firebase, Authentication State Persistence**](https://firebase.google.com/docs/auth/web/auth-state-persistence) Firebase web apps keep the user signed in after the browser closes, unless the code sets a different persistence. With session persistence, closing the tab signs the user out; with none, a page refresh does. Search the code for setPersistence and use local unless you want short sessions on purpose.
2. 02 ### **Users move between two web addresses**
> “Note that Firebase Auth web sessions are single host origin and will be persisted for a single domain only.” [**Firebase, Authentication State Persistence**](https://firebase.google.com/docs/auth/web/auth-state-persistence) A sign-in on www.example.com is not a sign-in on example.com or app.example.com. If links, emails or redirects send users between versions of your address, they look logged out on the other one. Redirect every version to one address.
3. 03 ### **The app checks for the user before Firebase has loaded**
> “currentUser might also be null because the auth object has not finished initializing.” [**Firebase, Manage Users in Firebase**](https://firebase.google.com/docs/auth/web/manage-users) When the app starts, Firebase takes a moment to load the saved session. An app that reads currentUser in that moment sees no user and shows the login screen, even though the user is still signed in. Wait for onAuthStateChanged before deciding which screen to show.
4. 04 ### **A password or email change ended their session**
> “A major account change is detected for the user. This includes events like password or email address updates.” [**Firebase, Manage User Sessions**](https://firebase.google.com/docs/auth/admin/manage-sessions) When a user changes their password or email address, or resets the password, Firebase revokes their refresh tokens, so their sign-in ends and they have to sign in again. That is on purpose. If an admin tool or a script changes users’ passwords or email addresses in bulk, those users are signed out too.
5. 05 ### **Users drop after about an hour: the server keeps an old ID token**
> “Firebase ID tokens are short lived and last for an hour” [**Firebase, Manage User Sessions**](https://firebase.google.com/docs/auth/admin/manage-sessions) The Firebase SDK in the app refreshes the ID token for you. A server that saves the ID token in its own cookie and checks it on each request starts rejecting it once the hour is up. Use a Firebase session cookie, which you can make last longer, or send a fresh ID token with each request.
Checked against the vendor’s docs on November 12, 2026: [Firebase docs: Manage User Sessions](https://firebase.google.com/docs/auth/admin/manage-sessions); [Firebase docs: Authentication State Persistence](https://firebase.google.com/docs/auth/web/auth-state-persistence); [Firebase docs: Manage Users in Firebase](https://firebase.google.com/docs/auth/web/manage-users); [Firebase docs: Manage Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Firebase auth/user-token-expired**](https://app369.com/fix/firebase-auth-user-token-expired/) · [**Firebase auth/requires-recent-login**](https://app369.com/fix/firebase-auth-requires-recent-login/) · [**Supabase users logged out with Invalid Refresh Token**](https://app369.com/fix/supabase-users-logged-out-refresh-token/) · [**Firebase push notifications not working**](https://app369.com/fix/firebase-push-notifications-not-working/)
Questions
## **More on this error**
**How long does a Firebase sign-in last? **+
Until the user signs out, or until their refresh token expires, which Firebase says happens only when the user is deleted, disabled or has a major account change. The one-hour ID token is renewed with the refresh token.
**How long can a Firebase session cookie last? **+
Firebase lets you set custom expiration times ranging from 5 minutes to 2 weeks when you create the session cookie on your server.
**Can I sign a user out of every device on purpose? **+
Yes. The Admin SDK can revoke a user’s refresh tokens, for example when they report a lost or stolen device. On revocation, Firebase signs the user out and asks them to sign in again.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)