title: Handling authentication persistence in React (with Redux and Firebase)
body: <p>In my React project, I've implemented authentication using Firebase. The workflow is as follows - The UID which is received upon signing in with Google OAuth is used to query the users in the firestore, and accordingly, the user is fetched. This user is then updated to the redux state by the appropriate handler functions. This is the implementation of the sign-in process. The setUser function does the task of updating the redux state</p>
  <pre><code>googleAuth = async () =&gt; {
      firebase.auth().signInWithPopup(provider).then(async (res) =&gt; {
          const uid = res.user.uid;
          const userRef = firestore.collection('users').where('uid', '==', uid);
          const userSnap = await userRef.get();
          if(!userSnap.empty) {
              const user = userSnap.docs[0].data();
              this.props.setUser(user);
          }
          this.props.history.push('/');
      }).catch(err =&gt; {
          alert(err.message);
      })
  }
  </code></pre>
  <p>The presence of &quot;currentUser&quot; field in the user state of redux, as a result of the aforementioned setUser function, is the basis of opening the protected routes and displaying relevant user-related details in my project. This currentUser is persisted in the state using Redux Persist, so as long as I don't sign out, the localStorage has the &quot;currentUser&quot; object stored, thus meaning that I am signed in.</p>
  <p>This implementation, however, causes a problem, that if I update the localStorage using the console and set the currentUser without actually logging in using my Google credentials, the app recognises me as logged in, and I am able to browse all protected routes. Thus, if someone copies some other user's details from his device's localStorage, then he/she can easily access their account and change/delete important information.</p>
  <p>What is the correct way to implement authentication in React then, assuming that I do want login state to persist until the user does not sign out manually</p>