Push alarm notifications are still received after logout.

[OmMakwana221]

ThingsBoard Platform Version

v4.3.1.1

Affected platforms

Android

ThingsBoard Platform Type

ThingsBoard PE Cloud

App Release Version

1.8.1

App type

ThingsBoard Cloud app

Steps to reproduce

1. Log in to the ThingsBoard Mobile App.
2. Ensure push notifications are enabled and alarm notifications are working correctly.
3. Leave the app unused until the authentication token expires (or wait for the automatic logout to occur).
4. Confirm that the user has been automatically logged out (without manually logging out).
5. Trigger a new alarm notification for the same user/device.

Expected results

• Once the user has been automatically logged out because the authentication token has expired, the application should no longer receive push notifications.
• The FCM token should either be removed, unregistered, or ignored after the session becomes invalid.
• Push notifications should only be delivered to authenticated users with an active session.

Actual results

• Even after the application has automatically logged out due to token expiration, the device continues to receive alarm push notifications.
• This means notifications are delivered to a user who is no longer authenticated.
• This is a security and privacy concern because notifications continue to be received after the session has ended.

Additional information

This is a critical issue and should be addressed as soon as possible.

If fixing this requires changes in a future mobile app release that may take some time, could you please provide:

• A temporary workaround, or
• The required code changes to unregister/delete the FCM token when the user is automatically logged out due to token expiration.

[OmMakwana221]

Hi team,

Just following up on this issue. It's been about 4 days since I reported it, and I haven't received any update yet.

[OmMakwana221]

Hi @deaflynx,

Just wanted to follow up on this issue again. There hasn't been any response yet, and it's been over a week since it was reported.
This is a critical issue. If a fix cannot be included in the next app release, could you please suggest a workaround.

[HKPhysicist]

Do you have your support channel from Thingsboard?

If you subscribe more expensive plans, you can get better technical support.

[deaflynx]

Hi @OmMakwana221,

Apologies for the late reply, and thanks for the detailed report.

It indeed looks like a bug: on automatic logout (token expiry) the app doesn't unregister the device, so notifications keep arriving. Manual logout from within the app correctly stops them.

We'll try to prepare a workaround as soon as possible (hope till the end of this week) and include the fix in the next release.

[deaflynx]

Hi @OmMakwana221,

As workaround you may do the client-side fix in lib/core/auth/login/provider/login_provider.dart, inside handleUserLoaded():

Change

if (!_tbClient.isAuthenticated()) {
      state = const LoginState(isUserLoaded: false);
      return;
}

To

if (!_tbClient.isAuthenticated()) {
      if (getIt<IFirebaseService>().apps.isNotEmpty && state.isFullyAuthenticated()) {
        await getIt<NotificationService>().logout();
      }
      state = const LoginState(isUserLoaded: false);
      return;
}

This unregisters the FCM token/mobile session when the session expires, so notifications stop once the app is opened again after expiry. Note, since this runs in the app, it can only unregister the next time the app is opened — notifications may still arrive in the gap between expiry and the next launch. Fully closing that gap needs a server-side change, so we'll consult with the platform team on the best overall fix and maybe include it in an upcoming release.