title: How to refresh a Firebase Session Cookie? (auth/session-cookie-expired)
body: <p>My application uses a server-side Firebase session cookie. Everything from sign in to sign out is implemented with their <a href="https://firebase.google.com/docs/auth/admin/manage-cookies" rel="nofollow noreferrer">official way</a> in mind. However, if I don't use the application for some time, the session cookie will expire eventually. I have two options:</p>
  
  <ol>
  <li>sign out the user and redirect to the sign in page</li>
  <li>silently re-authenticate the user by refreshing the session cookie on the server</li>
  </ol>
  
  <p>No questions about option 1. How would I implement option 2, if possible, with Firebase though?</p>
  
  <hr>
  
  <ol start="2">
  <li>The only thing I have is the <strong>expired</strong> session cookie on the client and server. At the moment, my server has a middleware which would return an authentication error:</li>
  </ol>
  
  <pre><code>export default async (
    req,
    res,
    firebaseAdmin
  ) =&gt; {
    const { session } = req.cookies;
  
    if (!session) {
      return null;
    }
  
    const checkRevoked = true;
  
    return await firebaseAdmin
      .auth()
      .verifySessionCookie(session, checkRevoked)
      .then(decodedClaims =&gt; {
        return firebaseAdmin.auth().getUser(decodedClaims.uid);
      })
      .catch(error =&gt; {
        throw new AuthenticationError(error.message);
      });
  };
  </code></pre>
  
  <p>Is there any way I can use the <code>auth/session-cookie-expired</code> error message to re-authenticate the user silently? Perhaps I shouldn't do this in the first place -- because of security issues -- and just go with option 1.</p>