Deletion of User in firebase does not trigger onAuth method

Question

When a user is deleted via the Registered Users section of the Login & Auth firebase web interface, the onAuth method is not triggered and the user remains logged in and able to write to database. How can one ensure that the user's session is destroyed then the user is deleted?

Answer 1

Security rules.

When a user is deleted they are not immediately unauthenticated. However, you can write your security rules in a way that protects private data from users who no longer exist.

Take the following data for example.

{
  "privateData": "only authenticated and existing users can read me!,
    "users": {
      "user1": "Alice",
      "user2": "Bob"
    }
  }
}

In this situation we only want users in the /users list to have access to the /privateData location. A simple auth != null would work, until one of the users is removed.

{
   "rules": {
     "privateData": {
        ".read": "auth != null && auth.uid == root.child('users').child(auth.uid).exists()",
        ".write": "auth != null && auth.uid == root.child('users').child(auth.uid).exists()"
     }
   }
}

The rules above not only check for an authenticated user, but they also check that the user exists in the /users location.

The token will expire and they will no longer be able to login. But with robust security rules you can guarantee they have no longer have access to any data.