Firebase Auth does not restore a user for recently active iOS users

[zsofiaserenyi]

Description

What happened

We are investigating an iOS authentication-state mismatch affecting roughly 1% of recently active users.

Our app has a legacy API access token stored in the iOS Keychain. Historically, its presence lets the user enter the authenticated app.

For affected users, that legacy token still exists, but Firebase Auth cannot find or restore a user. As a result, we cannot obtain an ID token or make authenticated API requests. The user enters the app but ends up in a broken authenticated state because all auth-required content and requests fail.

Some affected users were active within the last 90 days, including some within the last few days. Some also show recent activity on our web app. We do not see evidence of a password reset for the affected examples.

Firebase Auth state observed

During app launch or foregrounding:

let currentUser = Auth.auth().currentUser

do {
    let storedUser = try Auth.auth().getStoredUser(forAccessGroup: nil)
    // storedUser is nil for affected cases
} catch {
    // We have not observed an error for affected cases.
}

Auth.auth().addStateDidChangeListener { _, user in
    // user remains nil for affected cases
}

• For affected users:
  • Auth.auth().currentUser is nil.
  • getStoredUser(forAccessGroup: nil) is nil.
  • The auth-state listener does not later provide a non-nil user.
  • We have not observed an error from these checks.
  • We wait up to two seconds for the listener, retry once after 500 ms, and wait for up to a further two seconds. Firebase still does not restore a user in affected cases.
• This does not appear to be only an immediate startup timing issue.

Possible device-migration factor

• One hypothesis is device migration or backup restore: our legacy Keychain access token may remain available while Firebase Auth's persisted user state is unavailable. This could explain some affected users, but we cannot confirm it and it does not explain all cases, including users with recent activity on the same device or web activity.

Expected behavior

• For a recently authenticated user, we would expect Firebase Auth either to restore the Firebase user or provide a diagnosable failure state that explains why restoration is not possible.
• Instead, Firebase returns no current user, no stored user, and no later authenticated auth-state callback without an observed error.

Question and planned recovery

• We are changing the app to use Firebase Auth as the source of truth for routing users.
• When Firebase cannot provide a user, we plan to clear the stale legacy session and require sign-in again rather than allow the user into a broken authenticated app.
• Is this the recommended recovery when currentUser, getStoredUser(forAccessGroup:), and the auth-state listener all fail to provide a Firebase user?
• We would also like to understand why Firebase can reach this state for recently active users, and whether there is a supported recovery path that does not require user interaction.

Reproduction

• We do not currently have reliable reproduction steps. The issue is observed through production diagnostics for recently active users.

Environment

• Platform: iOS
• Firebase Auth SDK version: 12.12.1
• Installation method: SPM
• iOS versions: observed across iOS 17 and later
• Xcode version: 26.0.1
• Auth providers affected: email/password, Google, Apple
• Approximate affected rate: ~1% of recently active users
• App state when observed: mostly active; some inactive

Reproducing the issue

• No reliable reproduction currently. This is observed through production diagnostics for recently active users.

Firebase SDK Version

12.12.1

Xcode Version

26.0.1

Installation Method

Swift Package Manager

Firebase Product(s)

Authentication

Targeted Platforms

iOS