so I've been following this documentation about Managing session cookies in firebase, I followed their example almost exactly (I did some tweaks here in there). anyway everything was going as expected except signing out the user, I sign the user out by cleaning the cookies and using the revokeRefreshTokens() method (like they did in the documentation):

router.get("/logout", async (req, res) => {
     const sessionCookie = req.cookies.session || "";
     res.clearCookie("session")
     try {
         const decodedClaims = await admin.auth().verifySessionCookie(sessionCookie);
         await admin.auth().revokeRefreshTokens(decodedClaims.sub);
         res.redirect("/login")
     } catch (e) {
         req.flash("error", "Already logged out")
         res.redirect("back");
     }
});

the problem here is when the user signs out and then immediately tries to log back in, he can't and I get this error on my server: The provided Firebase ID token is expired, the user must wait 30-50 seconds so he can log back in.

So my questions are:

• Do I need to revokeRefreshTokens() in order to sign the user out?
• Is the behaviour (not allowing the user to log back in for 30s-50s) of this method is intended?

Note: In the documentation they've used the client sdk to authenticate the user, Instead I used the Auth REST API (in the backend ofcourse).