Firebase Auth: Unable to update custom claims after setting them with createCustomToken

Question

Details If you use the function createCustomToken to sign in the user and setting his custom claim, updating the custom claims later using the function setCustomUserClaims will not update the claims even after forcing the idToken to refresh using the function firebase.auth().currentUser.getIdTokenResult(true) How to reproduce? Sign in the user on firebase using a custom token generated with the function createCustomToken including the custom claims firebase.auth().createCustomToken(uid, {myClaim: "test"}).then((customToken) => console.log(customToken)) Sign in the user on the frontend using the custom token // copy paste the customToken manually for testing firebase.auth().signInWithCustomToken(customToken) Update the claim on the backend using setCustomUserClaims firebase.auth().setCustomUserClaims(uid, {myClaim: "updateTest"}) Refresh the idToken on the frontEnd and log the custom claims firebase.auth().currentUser .getIdTokenResult(/*force refresh*/ true) .then((idTokenResult) => { console.log(`custom claims`, idTokenResult.claims) }) You should see that the claim is still { myClaim: "test" } instead of { myClaim: "updateTest" } JavaScript questions and answers, JavaScript questions pdf, JavaScript question bank, JavaScript questions and answers pdf, mcq on JavaScript pdf, JavaScript questions and solutions, JavaScript mcq Test , Interview JavaScript questions, JavaScript Questions for Interview, JavaScript MCQ (Multiple Choice Questions)

Answer 1

Edit: This is actually an intended behavior. The claims set with createCustomToken have a higher priority. The doc mentions it here https://firebase.google.com/docs/auth/admin/custom-claims#set_and_validate_custom_user_claims_via_the_admin_sdk Setting the custom claims separately at sign in instead of using the function createCustomToken to set them will allow you to edit these claims later. Working code: firestore .doc(`users/${uid}`) .get() .then((clientSnapshot) => { // give user the claims he has const { permissions = {} } = clientSnapshot.data() // use setCustomUserClaims to set the claims return auth.setCustomUserClaims(uid, { permissions }) }) // generate the custom token // ⚠️ don't use createCustomToken to set permission as you won't be able to update them .then(() => auth.createCustomToken(uid)) .then((customToken) => { // send the custom token to the frontend to sign the user in return res.status(200).json({ customToken }) })