123 results found
-
9 votes
-
Add option to block client-side password reset in firebase
See here: https://stackoverflow.com/questions/77313457/block-client-side-password-reset-in-firebase
I would like to be able to disable all client-side password resets, both sending a password reset email and directly updating a password after re-authenticating so I can do all my logic though the admin API in functions.
For example, add and option in Authentication -> settings -> user actions that blocks client-side password resets (throws an 'auth/admin-restricted-operation')
(Would be nice to have this option for all auth functions, so you can decide to control access for everything better)
8 votes -
Authenticate via email code
We can now use passwordless authentication using email link. This is troublesome on Flutter web clients (a new tab/second instance of app is opened). An option to type 4 digit code received on email to authenticate would be a nice solution.
BTW. Let me know if you could help me with the email link web client authentication, thanks!7 votes -
Allow enabling Firebase Auth programmatically
Instead enabling Firebase Auth manually, by navigating to the "Authentication" tab in Firebase Console and clicking "Get started", can we do all of this programmatically?
7 votes -
Anyone can exhaust your Auth quota and take the project down
Rejected requests to identitytoolkit (401 invalid App Check, 400 per-IP) and securetoken (refresh) still count against the project quotas (1,000 QPS, 10M/day, 18,000/min) — confirmed by measurement and Firebase Support (case #10417533). A single IP with no valid credentials can consume shared quota. Developers have no WAF or per-IP rate limiting for these client-facing endpoints, and no supported mitigation, so an external party can force an Auth availability outage on any project using client-side Auth.
AWS Cognito solves this: attach a WAF web ACL to a user pool, and blocked requests don't count toward quota. Please add equivalent edge filtering…
6 votes -
Firebase Auth with IP address whitelist & blacklist
Blacklist scenario: Let's say that a device is detected for fraud/scam activity. I want to blacklist the device for 1 year based on the previously logged-in IP address, so the scammer is no longer able to use their devices. Even though the scammer created a new Firebase account, they won't be able to do that because of the IP address blacklist.
Whitelist scenario: Let's say that I have an internal app. I want this app to be used by my employees only, so only specific devices are allowed to login.
6 votes -
RecaptchaVerifier should provide access to the shared secret
I'm creating a Contact form in a React app, which stores the user input in firebase. I'd like to secure the form with a visible reCAPTCHA, and I'm trying out firebase's built-in reCAPTCHA functionality.
firebase/auth/RecaptchaVerifierdoes provide a callback, which can be used to sign in a user, and documentation shows it working when signing in with a phone number. Can it be used with anonymous authentication though?When the form is submitted, I have a server component that saves the form fields to firestore. However, how can I verify the recaptcha before committing the data to firestore?
I feel…
6 votes -
6 votes
-
Pre-built User Authentication & Common App Features
We propose adding a suite of pre-built, configurable modules for user authentication and other common application features directly into Firebase Studio. This would allow developers to quickly set up essential functionality without writing repetitive boilerplate code.
Why this is important: Many developers spend significant time implementing standard features like user registration, login, and profile management. By providing these components out-of-the-box, Firebase Studio would enable developers to skip these steps and focus immediately on building their app's unique and core functionality. This would dramatically accelerate development speed and improve time-to-market.
Core Features to Include: User Authentication Module: A ready-to-use system for…
5 votes -
Use readable date format for email sign-in
According to
https://firebase.google.com/docs/auth/web/email-link-auth#default-email
and
https://github.com/firebase/firebase-js-sdk/issues/2574
The email sign in template contains a timestamp in the email title and body, so email are not collapsed into a sigle thread.I believe the current date time format, such as 2024 November 11 13:33 UTC is not user friendly, and should be replaced with a more readable format, such as Nov. 11, 2024, 11:33.
The mail language is already based on the language set in the Firebase Authentication -> Template language section, so the formatting can be done based on the same setting, or a new option can be added in the Firebase…
5 votes -
Make Phone Auth support MFA
Food delivery services usually need to know the phone number of their customers, to guarantee that the deliveries will be smooth.
So, a food delivery app would probably prefer authenticating users by phone number rather than by email address.
Phone auth on its own isn’t particularly secure, though, so it would be nice to allow users to optionally add email authentication as a second factor.
As of right now, phone auth doesn’t support MFA, though, which means that a food delivery app might want to force users to use email and phone 2FA right away, which might seem intrusive to…
5 votes -
Allow configuring standard Firebase Authentication via Terraform
The google Terraform providers allow creating and configuring Firebase projects via Terraform.
This includes Firebase Authentication via the googleidentityplatform_config Terraform resource, but also forces an upgrade to Firebase Authentication with Identity Platform.
Identity Platform has a much higher cost.
We'd like to be able to configure standard Firebase Authentication via Terraform
5 votes -
Include User Online Feature
Just like we have user logged in etc, can we have isUserOnline?
5 votes -
Enhance password security
Currently, it is entirely possible for a user to reset a password that is unsecure with firebase's miniapp
it does not validate against the default password conditions or reference the identity toolkit policies
a community member has created a temporary fix
https://betterprogramming.pub/firebases-password-reset-is-insecure-here-s-how-to-fix-it-882629e3b779I propose this reset dialog gets enhanced to a standard.
and allow projects to integrate password policies from the identity toolkit
https://cloud.google.com/identity-platform/docs/password-policy5 votes -
Login with WhatsApp
Just like phone auth, WhatsApp auth would be greatly beneficial for Asian markets. Users don't need to verify with OTP and us developers get access to their WhatsApp directly for promotion purposes.
5 votes -
Option to enable MFA by provider
There should be an option to turn on MFA for a user for specific provider (e.g., password). Since user's Google signin might have MFA already, it's sort of inconvenient to have extra MFA barrier for Firebase Auth tenant.
5 votes -
MFA option to "remember device"
User shouldn't have to enter MFA every time logging in on same device. There should be a boolean option remember device for some period of time (somewhere between 2 weeks and forever)
5 votes -
Support for One-Time Code (Passwordless) Login
Firebase Auth should offer a native one-time code login flow, similar to Azure AD’s Device Code Flow.
This would allow users to authenticate by entering a short code received via email, without clicking links or relying on deep links, which often fail in desktop or web apps.
A simple code-based login would make authentication more inclusive, faster, and reliable for all users, especially those without social accounts or using devices different from their email client.
4 votes -
Any one hacke my phone automatically attacks how track that devices totally collapsed
Hel that himself completely distracted.
Only one system connected.4 votes -
One click Auth setup
like lovable+supabase
4 votes
- Don't see your idea?