Short answer
Firebase sessions are long lived: refresh tokens expire only when the user is deleted or disabled, or after a major account change such as a new password or email address. If users drop at other times, check how the web app stores the session (local, session or none), whether users switch between domains, whether the app reads the current user before Firebase has loaded it, and whether a server keeps the one-hour ID token without refreshing it.
Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
Why users get logged out, and the fix
01
The web app keeps the session only for the tab
“will be cleared when the tab or window in which the user authenticated is closed” Firebase, Authentication State Persistence
Firebase web apps keep the user signed in after the browser closes, unless the code sets a different persistence. With session persistence, closing the tab signs the user out; with none, a page refresh does. Search the code for setPersistence and use local unless you want short sessions on purpose.
02
Users move between two web addresses
“Note that Firebase Auth web sessions are single host origin and will be persisted for a single domain only.” Firebase, Authentication State Persistence
A sign-in on www.example.com is not a sign-in on example.com or app.example.com. If links, emails or redirects send users between versions of your address, they look logged out on the other one. Redirect every version to one address.
03
The app checks for the user before Firebase has loaded
“currentUser might also be null because the auth object has not finished initializing.” Firebase, Manage Users in Firebase
When the app starts, Firebase takes a moment to load the saved session. An app that reads currentUser in that moment sees no user and shows the login screen, even though the user is still signed in. Wait for onAuthStateChanged before deciding which screen to show.
04
A password or email change ended their session
“A major account change is detected for the user. This includes events like password or email address updates.” Firebase, Manage User Sessions
When a user changes their password or email address, or resets the password, Firebase revokes their refresh tokens, so their sign-in ends and they have to sign in again. That is on purpose. If an admin tool or a script changes users’ passwords or email addresses in bulk, those users are signed out too.
05
Users drop after about an hour: the server keeps an old ID token
“Firebase ID tokens are short lived and last for an hour” Firebase, Manage User Sessions
The Firebase SDK in the app refreshes the ID token for you. A server that saves the ID token in its own cookie and checks it on each request starts rejecting it once the hour is up. Use a Firebase session cookie, which you can make last longer, or send a fresh ID token with each request.
Checked against the vendor’s docs on : Firebase docs: Manage User Sessions; Firebase docs: Authentication State Persistence; Firebase docs: Manage Users in Firebase; Firebase docs: Manage Session Cookies.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start
“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
Related: Firebase auth/user-token-expired · Firebase auth/requires-recent-login · Supabase users logged out with Invalid Refresh Token · Firebase push notifications not working