Request retry best practices

Question

i am building application using Flutter, GraphQL and Firebase with NodeJS API. In my applicaiton i have implmented Firebase auth and token refresh and my nodejs api validates it. My token refresh is with intervals of 3500 seconds (where token is valid for 3600). However in some situation (i do not kno why) after i am leaving app open for half a day i am starting to receiving message from token validation that i have to refresh token (not sure how to catch it because while testing intervals refresh works just fine)...

So what is most common way to refresh token in apps? maybe apps are automatically hybernated while inactive and refresh timers stopped? If yes - than what event should i use to to catch app became active again?

Thanks

p.s. After some research i realised what is the problem with token refresh in interval - while phone is active refresh interval works fine. If I lock phones screen time interval stops. After oepning phone again time interval starts again FROM BEGINNING. Here main problem occurs - since FB token is valid for 1 hour so there is 99% that iser will turn his phone screen of and after he turns it again timer will start from the beginning - but token will be expired...

Do you know any flutter events that are triggered after phone / app become active again?

Answer 1

An absolute golden rule in any OAuth client is to implement the following behaviour:

• If you get a 401 from an API
• Try to get a new access token - once only
• Retry the API call - once only

Some sample Android code of mine that does this.

The requirement is universal though, regardless of type of client or technology used. In my own apps I never read the token expiry and just let 401s happen. This is a resilient solution, since 401s can occur for many reasons.

I would recommend focusing on the requirements first and the technology second

Answer 2

Firebase Auth will automatically refresh the user's ID token ever hour, or as needed. You don't have to write any code for that.

The Android, iOS, and JS libraries all provide a way to listen to changes to the ID token, but Flutter apparently does not expose this API. However, you can still periodically call getIdToken(false) to get the current ID token. Just don't hold on to it for longer than necessary.

Answer 3

so after research i ended up solving it with 2 steps.

1. Initializing periodic token refresh with this code:

   void _handleAuthStateChanged(FirebaseUser e) async {
        if (e == null) {
        _authentication = null;
   } else {
    /// Get token
    final firebaseToken = await e.getIdToken(refresh: true);
   
    /// Setup token refresh
    firebaseToken.expirationTime.asFuture(() async {
        var user = await FirebaseAuth.instance.currentUser();
        _handleAuthStateChanged(user);
    });
   
    extension DateTimeFutureX on DateTime {
        Future<T> asFuture<T>([FutureOr<T> Function() computation]) async {
        final difference = this.difference(DateTime.now());
        return Future.delayed(difference, computation);
    }
   }
   

2. and refetching token when app is resumed in main.dart

   @override
   Future<void> didChangeAppLifecycleState(AppLifecycleState state) async {
        super.didChangeAppLifecycleState(state);
        if (state == AppLifecycleState.resumed) {
            await _authService.refreshToken();
        }
    }