title: Firebase refresh-token expiration
body: <p>While testing the security of one of our product, a web application, using the REST API of Firebase we got surprised when we realised that <strong>refresh-tokens never expire</strong> in the V3 of the Firebase implementation, allowing any refresh-token to <strong>create new tokens forever</strong>.</p>
  
  <p>While local-storage seem a reasonably safe solution today, we are concerned by the possibility that <strong>it could fail tomorrow</strong>, even for a short amount of time, and that we cannot stop someone from using any of these refresh-tokens.</p>
  
  <p>Two factor authentication will help mitigate the issue, but the first step would become compromised nonetheless.</p>
  
  <p><strong>Is there a way to blacklist tokens, or similar behaviour, with Firebase, without handling all tokens exchange, such as minting, ourselves?</strong> We could not find such feature when going through the doc.</p>
  
  <p>Any advice appreciated.</p>