There are two types of notification messages public and private. Public messages can be seen by anybody who is using this application. Private messages are meant to be seen by only one user. These private messages may contain some confidential information.
While implementing this scenario on iOS. The FCM token for the device is per application instance ( i.e. on app re-install user may get the new fcm token).
Let's say user A logs out. Now, As the server has his device associated with an fcm token server may send some private information.
Few suggestions are to break the association of token with user session by having logout API. But then what about offline logout? Why isn't there any association of user session with FCM token? How can we handle it in offline log-out with no private push message delivery?
Questions reviewed already :
How to refresh FCM Token on user Logout?