94 results found

1. Allow enabling Firebase Auth programmatically

   Instead enabling Firebase Auth manually, by navigating to the "Authentication" tab in Firebase Console and clicking "Get started", can we do all of this programmatically?

   7 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. Automatic SMS OTP read with English templates

   For automatic SMS retrieval to work, SMS length has to be under 64 bytes. This means currently that for English SMS template, the app name has to be 11-14 characters. Play Console allows max 30 characters. Firebase doesn't allow customers to modify the SMS template contents themselves. Now I'm working around by utilizing some other languages, that will fit below 64 bytes with current app name.

   Two options I suggest to achieve this:
   1) Modify the English SMS template: remove unnecessary filler words and make it shorter, so that it will fit to 64bytes with max 30 char app names.

   or

   2) Add support to Firebase SMS Templates for English variants, so those could be used solely for sending out OTP SMS with shorter app names set in the Store listing.

   For automatic SMS retrieval to work, SMS length has to be under 64 bytes. This means currently that for English SMS template, the app name has to be 11-14 characters. Play Console allows max 30 characters. Firebase doesn't allow customers to modify the SMS template contents themselves. Now I'm working around by utilizing some other languages, that will fit below 64 bytes with current app name.

   Two options I suggest to achieve this:
   1) Modify the English SMS template: remove unnecessary filler words and make it shorter, so that it will fit to 64bytes with max 30 char app names.

   … more

   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. Feature to increase the number of whitelisted phone numbers for testing
   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Use readable date format for email sign-in

   According to
   https://firebase.google.com/docs/auth/web/email-link-auth#default-email
   and
   https://github.com/firebase/firebase-js-sdk/issues/2574
   The email sign in template contains a timestamp in the email title and body, so email are not collapsed into a sigle thread.

   I believe the current date time format, such as 2024 November 11 13:33 UTC is not user friendly, and should be replaced with a more readable format, such as Nov. 11, 2024, 11:33.

   The mail language is already based on the language set in the Firebase Authentication -> Template language section, so the formatting can be done based on the same setting, or a new option can be added in the Firebase Console to select a format.

   According to
   https://firebase.google.com/docs/auth/web/email-link-auth#default-email
   and
   https://github.com/firebase/firebase-js-sdk/issues/2574
   The email sign in template contains a timestamp in the email title and body, so email are not collapsed into a sigle thread.

   I believe the current date time format, such as 2024 November 11 13:33 UTC is not user friendly, and should be replaced with a more readable format, such as Nov. 11, 2024, 11:33.

   The mail language is already based on the language set in the Firebase Authentication -> Template language section, so the formatting can be done based on the same setting, or a new option can be added in the Firebase… more

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. Allow configuring standard Firebase Authentication via Terraform

   The google Terraform providers allow creating and configuring Firebase projects via Terraform.

   This includes Firebase Authentication via the googleidentityplatform_config Terraform resource, but also forces an upgrade to Firebase Authentication with Identity Platform.

   Identity Platform has a much higher cost.

   We'd like to be able to configure standard Firebase Authentication via Terraform

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. RecaptchaVerifier should provide access to the shared secret

   I'm creating a Contact form in a React app, which stores the user input in firebase. I'd like to secure the form with a visible reCAPTCHA, and I'm trying out firebase's built-in reCAPTCHA functionality.

   firebase/auth/RecaptchaVerifierdoes provide a callback, which can be used to sign in a user, and documentation shows it working when signing in with a phone number. Can it be used with anonymous authentication though?

   When the form is submitted, I have a server component that saves the form fields to firestore. However, how can I verify the recaptcha before committing the data to firestore?

   I feel like the server component that commits to firestore needs to first verify g-recaptcha-response submitted with the FormData. But to do that, to use the reCaptcha API to verify the recaptcha response, requires a secret shared between my site and the reCaptcha API. Can my server component handling the form submission access the shared secret that firebase auth automatically creates?

   Some references:-

   https://firebase.google.com/docs/auth/web/phone-auth#set-up-the-recaptcha-verifier
   https://developers.google.com/recaptcha/docs/verify

   I'm creating a Contact form in a React app, which stores the user input in firebase. I'd like to secure the form with a visible reCAPTCHA, and I'm trying out firebase's built-in reCAPTCHA functionality.

   firebase/auth/RecaptchaVerifierdoes provide a callback, which can be used to sign in a user, and documentation shows it working when signing in with a phone number. Can it be used with anonymous authentication though?

   When the form is submitted, I have a server component that saves the form fields to firestore. However, how can I verify the recaptcha before committing the data to firestore?

   I feel… more

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. Enhance password security

   Currently, it is entirely possible for a user to reset a password that is unsecure with firebase's miniapp

   it does not validate against the default password conditions or reference the identity toolkit policies

   a community member has created a temporary fix
   https://betterprogramming.pub/firebases-password-reset-is-insecure-here-s-how-to-fix-it-882629e3b779

   I propose this reset dialog gets enhanced to a standard.
   and allow projects to integrate password policies from the identity toolkit
   https://cloud.google.com/identity-platform/docs/password-policy

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Authenticate via email code

   We can now use passwordless authentication using email link. This is troublesome on Flutter web clients (a new tab/second instance of app is opened). An option to type 4 digit code received on email to authenticate would be a nice solution.
   BTW. Let me know if you could help me with the email link web client authentication, thanks!

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. MFA option to "remember device"

   User shouldn't have to enter MFA every time logging in on same device. There should be a boolean option remember device for some period of time (somewhere between 2 weeks and forever)

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. Suggestion for Enhanced Authentication Flow in Firebase Authentication

    Dear Firebase Support Team,

    I hope this message finds you well. I am reaching out to share a suggestion that I believe could greatly benefit Firebase Authentication and developers working on more complex applications.

    Currently, Firebase Authentication provides excellent flexibility with signInWithPhoneNumber and createUserWithEmailAndPassword, allowing projects to authenticate users using either a phone number or an email/password combination. However, in certain projects, both the phone number and email/password are essential to meet higher security standards and user profile requirements.

    In these cases, having an integrated authentication flow that combines signInWithPhoneNumber and createUserWithEmailAndPassword within a single, cohesive process would be highly valuable. This would allow developers to:

    Verify both Phone Number and Email in one seamless flow, ensuring that both contact methods are valid.
    Enhance Security and User Experience by allowing users to use either their phone number or email for future logins, while maintaining a smooth registration process.
    Create a More Complete User Profile right from the start, which is especially useful for applications that require strong user verification for sensitive data or financial transactions.
    Currently, implementing both methods within the same authentication process involves a multi-step workaround that can complicate the onboarding experience. A built-in support mechanism from Firebase could simplify this flow for developers and improve the overall user experience.

    I hope this suggestion resonates with your team and aligns with Firebase’s mission to provide developers with powerful, user-friendly tools. I would be thrilled to see this feature implemented in a future release.

    Thank you for considering this idea, and please let me know if I can provide any additional details.

    Best regards,

    Nicolas N'DAH

    Dear Firebase Support Team,

    I hope this message finds you well. I am reaching out to share a suggestion that I believe could greatly benefit Firebase Authentication and developers working on more complex applications.

    Currently, Firebase Authentication provides excellent flexibility with signInWithPhoneNumber and createUserWithEmailAndPassword, allowing projects to authenticate users using either a phone number or an email/password combination. However, in certain projects, both the phone number and email/password are essential to meet higher security standards and user profile requirements.

    In these cases, having an integrated authentication flow that combines signInWithPhoneNumber and createUserWithEmailAndPassword within a single, cohesive process would be highly… more

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. SSO accross subdomains
    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. Multifactor admin SDK: "Other Admin SDK languages are not currently supported."

    The page "Manage Multi-factor Users" (https://firebase.google.com/docs/auth/admin/manage-mfa-users) says "Install the Node.js Admin SDK. Other Admin SDK languages are not currently supported."

    It's odd that this random feature doesn't work in other languages. Please add them (mainly C#).

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Login with WhatsApp

    Just like phone auth, WhatsApp auth would be greatly beneficial for Asian markets. Users don't need to verify with OTP and us developers get access to their WhatsApp directly for promotion purposes.

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Raise the custom claims size limit
    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. Option to enable MFA by provider

    There should be an option to turn on MFA for a user for specific provider (e.g., password). Since user's Google signin might have MFA already, it's sort of inconvenient to have extra MFA barrier for Firebase Auth tenant.

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

16. Setting to disable returning auth error type

    Currently errors such as "wrong password", "user with this email doesn't exists" etc are always returned to client. Would be nice to have the option to only return a generic error message to improve security.

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

17. Separate/standalone Authentication admin library

    Quite often I only need the firebase-admin/auth part of the NodeJS admin library. Especially when separating the application into single-purpose containers/microservices.

    However because there is no separate NPM package for the auth part, I need to pull in the entire firebase-admin package, which pulls in a HUGE number of dependencies like @google-cloud/firestore @google-cloud/storage, google-gax, @grpc/grpc-js protobufjs and a multitude of others which are not needed for the auth part.

    Much of the other components like Firestore, Storage etc can be used directly from the @google-cloud/... libraries without the entire firebase-admin package.

    But there is no separate package for Authentication.

    Authentication is almost always the simplest, single most necessary part of an application, whether the app/microservice is complex or simple. It would be great to have a separate NPM package for Authentication only (without all the other dependencies) because ofthen that is all I need in a simple application/container. Especially when separating the application into single-purpose containers/microservices.

    Quite often I only need the firebase-admin/auth part of the NodeJS admin library. Especially when separating the application into single-purpose containers/microservices.

    However because there is no separate NPM package for the auth part, I need to pull in the entire firebase-admin package, which pulls in a HUGE number of dependencies like @google-cloud/firestore @google-cloud/storage, google-gax, @grpc/grpc-js protobufjs and a multitude of others which are not needed for the auth part.

    Much of the other components like Firestore, Storage etc can be used directly from the @google-cloud/... libraries without the entire firebase-admin package.

    But there is no separate package for Authentication.

    Authentication… more

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

18. Masking sender phone number for SMS verification
    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

19. Make Phone Auth support MFA

    Food delivery services usually need to know the phone number of their customers, to guarantee that the deliveries will be smooth.

    So, a food delivery app would probably prefer authenticating users by phone number rather than by email address.

    Phone auth on its own isn’t particularly secure, though, so it would be nice to allow users to optionally add email authentication as a second factor.

    As of right now, phone auth doesn’t support MFA, though, which means that a food delivery app might want to force users to use email and phone 2FA right away, which might seem intrusive to users, even if you implement anonymous auth and explain why you’re asking for both email and phone.

    Food delivery services usually need to know the phone number of their customers, to guarantee that the deliveries will be smooth.

    So, a food delivery app would probably prefer authenticating users by phone number rather than by email address.

    Phone auth on its own isn’t particularly secure, though, so it would be nice to allow users to optionally add email authentication as a second factor.

    As of right now, phone auth doesn’t support MFA, though, which means that a food delivery app might want to force users to use email and phone 2FA right away, which might seem intrusive to… more

    3 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

20. Expand auth blocking functions

    Support some additional data sent during the signInWithEmailAndPassword that can be read in the beforeCreate

    3 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating