[Firebase Authentication] Why can't get a IdP Refresh Token?

[k2wanko]

Hello

In the process of implementing authentication, I was wondering if I could ask you a question.

In general, OIDC uses Refresh Token to reissue an Access Token when it becomes invalid, but why does the SDK not return Refresh Token?

This API [1] returns the Refresh Token by adding returnRefreshToken: true to the parameter.

Is there some security reason why it doesn't return the Refresh Token?

[1] https://cloud.google.com/identity-platform/docs/reference/rest/v1/accounts/signInWithIdp

https://firebase.google.com/docs/auth/web/microsoft-oauth#handle_the_sign-in_flow_with_the_firebase_sdk

SDK Code:

firebase-js-sdk/packages/auth/src/core/credentials/oauth.ts

Lines 176 to 180 in e1d551d

	private buildRequest(): SignInWithIdpRequest {
	const request: SignInWithIdpRequest = {
	requestUri: IDP_REQUEST_URI,
	returnSecureToken: true
	};