GetMetaData fails with unknown errors (-13020)

[sipersso]

Description

For some users calls to getMetaData fails with StorageError.unknown. Underlying error code is -13020, which seems to suggest "unauthenticated" errors. Users are signed in. It looks like it is intermittent and does go away for most users (although I am not 100% sure if it applies to all users).

Any ideas what this is? It is not super common, but seeing these for around 1% of user sessions. Could it be that an id token has expired just as the user is about to get metadata? Is there anything I could do to mitigate?

Reproducing the issue

I have not been able to reproduce this on my end.

Firebase SDK Version

11.12.0

Xcode Version

16.2

Installation Method

Swift Package Manager

Firebase Product(s)

Storage

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

Replace this line with the contents of your Package.resolved.

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[rizafran]

Thanks for reporting, @sipersso. Based on our docs, the error code -13020 means that User is unauthenticated. Authenticate and try again..You may try checking your security rules if configured correctly (see our docs for more info). Also, may I know if you enabled App Check enforcement?

[sipersso]

App check is not enabled, users are signed in. They are reaching out to support while signed into to their accounts. The problem seems to go away for them without having to sign in again.

I have verified the security rules. If they were incorrect no one would have been able to upload. Now it is an intermittent error

[rizafran]

Thanks for verifying, @sipersso. It's possible that the token is getting expired which is causing this experience, though it's weird that it's happening to 1% of users in your project. Have you tried some sort of retry for this?

Also, you mentioned that the problem seems to go away for them without having to sign in again. ~ It looks like the id token has expired and then the token refresh flow kicked in and generated a new id token, due to which the users didn't have to sign in again.

Does this issue cause any customer impact on your end or is it something you just observed in the logs?

[sipersso]

I don't think it is weird at all that it is only happening for 1% of sessions. If it is a token refresh, then it should not be happening very often right. Yeah, it does have customer impact. When this happens, the users uploads fail. I have an error message that is shown and I have had a lot of people reach out. I'd assume that the toke refreshes should be automatic, but can I force this to be updated from within the app? I mean, I can detect the issue (I show the error message now), but maybe I could try to manually refresh the token at that point?

It is not an error that goes away straight away for these users, the may be experiencing it for a while, then it can go away.

[rizafran]

Per checking with the team, it's possible that the user's upload took some time, causing the id token to expire in the middle of the process. With this, you could try manually refreshing the token using the getIDToken(forcingRefresh:) method before calling the getMetaData if it's something that takes time.