123 results found

1. Suggestion for Enhanced Authentication Flow in Firebase Authentication

   Dear Firebase Support Team,

   I hope this message finds you well. I am reaching out to share a suggestion that I believe could greatly benefit Firebase Authentication and developers working on more complex applications.

   Currently, Firebase Authentication provides excellent flexibility with signInWithPhoneNumber and createUserWithEmailAndPassword, allowing projects to authenticate users using either a phone number or an email/password combination. However, in certain projects, both the phone number and email/password are essential to meet higher security standards and user profile requirements.

   In these cases, having an integrated authentication flow that combines signInWithPhoneNumber and createUserWithEmailAndPassword within a single, cohesive process would be highly valuable. This would allow developers to:

   Verify both Phone Number and Email in one seamless flow, ensuring that both contact methods are valid.
   Enhance Security and User Experience by allowing users to use either their phone number or email for future logins, while maintaining a smooth registration process.
   Create a More Complete User Profile right from the start, which is especially useful for applications that require strong user verification for sensitive data or financial transactions.
   Currently, implementing both methods within the same authentication process involves a multi-step workaround that can complicate the onboarding experience. A built-in support mechanism from Firebase could simplify this flow for developers and improve the overall user experience.

   I hope this suggestion resonates with your team and aligns with Firebase’s mission to provide developers with powerful, user-friendly tools. I would be thrilled to see this feature implemented in a future release.

   Thank you for considering this idea, and please let me know if I can provide any additional details.

   Best regards,

   Nicolas N'DAH

   Dear Firebase Support Team,

   I hope this message finds you well. I am reaching out to share a suggestion that I believe could greatly benefit Firebase Authentication and developers working on more complex applications.

   Currently, Firebase Authentication provides excellent flexibility with signInWithPhoneNumber and createUserWithEmailAndPassword, allowing projects to authenticate users using either a phone number or an email/password combination. However, in certain projects, both the phone number and email/password are essential to meet higher security standards and user profile requirements.

   In these cases, having an integrated authentication flow that combines signInWithPhoneNumber and createUserWithEmailAndPassword within a single, cohesive process would be highly… more

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. SSO accross subdomains
   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. Add custom permissions claims to access tokens via Firebase web interface

   Firebase currently only allows you to add custom claims to ID tokens, and it suggests adding role based access control (RBAC) permissions in those ID token claims.

   RBAC custom claims should be added to the access token which is already included in the Authorization header in all API requests, so the API already has access to the token that it needs. Additionally including an ID token in API requests so that the API can read permissions from it is overly complicated and superfluous.

   Furthermore, you should be able to add these claims to access tokens for specific users via the Firebase web interface. Currently, you can only add custom claims to ID tokens by creating and running an app locally with the Firebase Admin SDK, which is a major pain in the neck.

   Auth0 does all of this already and, as a direct result of that, it is much easier to use than Firebase Auth.

   Firebase currently only allows you to add custom claims to ID tokens, and it suggests adding role based access control (RBAC) permissions in those ID token claims.

   RBAC custom claims should be added to the access token which is already included in the Authorization header in all API requests, so the API already has access to the token that it needs. Additionally including an ID token in API requests so that the API can read permissions from it is overly complicated and superfluous.

   Furthermore, you should be able to add these claims to access tokens for specific users via the… more

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Multifactor admin SDK: "Other Admin SDK languages are not currently supported."

   The page "Manage Multi-factor Users" (https://firebase.google.com/docs/auth/admin/manage-mfa-users) says "Install the Node.js Admin SDK. Other Admin SDK languages are not currently supported."

   It's odd that this random feature doesn't work in other languages. Please add them (mainly C#).

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. Auth: install, not only authorise, a GitHub app

   GitHub Apps are now the preferred alternative to GitHub Oauth Apps. When authenticating with Firebase Auth and a GitHub App, the app is "authorised" but not "installed", which can lead to inconsistent behaviour (https://github.com/orgs/community/discussions/61677). It would be nice if the GitHub provider had an option for prompting the user to "Authorise and Install" rather than only "Authorise".

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. Raise the custom claims size limit
   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. Create custom OTP request to revalidate user

   Firebase should have capability for the developer to generate OTP (sent on cellphone or email as per developer's requirement) and should have a mechanism to validate the OTP.
   This will be very useful during user authentication when changing some critical data/setting (especially related to finance/money) or when making payment.

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Setting to disable returning auth error type

   Currently errors such as "wrong password", "user with this email doesn't exists" etc are always returned to client. Would be nice to have the option to only return a generic error message to improve security.

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Separate/standalone Authentication admin library

   Quite often I only need the firebase-admin/auth part of the NodeJS admin library. Especially when separating the application into single-purpose containers/microservices.

   However because there is no separate NPM package for the auth part, I need to pull in the entire firebase-admin package, which pulls in a HUGE number of dependencies like @google-cloud/firestore @google-cloud/storage, google-gax, @grpc/grpc-js protobufjs and a multitude of others which are not needed for the auth part.

   Much of the other components like Firestore, Storage etc can be used directly from the @google-cloud/... libraries without the entire firebase-admin package.

   But there is no separate package for Authentication.

   Authentication is almost always the simplest, single most necessary part of an application, whether the app/microservice is complex or simple. It would be great to have a separate NPM package for Authentication only (without all the other dependencies) because ofthen that is all I need in a simple application/container. Especially when separating the application into single-purpose containers/microservices.

   Quite often I only need the firebase-admin/auth part of the NodeJS admin library. Especially when separating the application into single-purpose containers/microservices.

   However because there is no separate NPM package for the auth part, I need to pull in the entire firebase-admin package, which pulls in a HUGE number of dependencies like @google-cloud/firestore @google-cloud/storage, google-gax, @grpc/grpc-js protobufjs and a multitude of others which are not needed for the auth part.

   Much of the other components like Firestore, Storage etc can be used directly from the @google-cloud/... libraries without the entire firebase-admin package.

   But there is no separate package for Authentication.

   Authentication… more

   4 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Authentication  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. Masking sender phone number for SMS verification
    4 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. 39

    Subject: Phone Auth - Real numbers failing with error code 39 despite correct configuration (Blaze plan)

    Project ID: washgo-1582e

    We are experiencing a persistent issue with Firebase Phone Authentication on Android (React Native / @react-native-firebase/auth). Test phone numbers work correctly, but real phone numbers consistently fail.

    Error observed:
    [auth/unknown] An internal error has occurred. [ Error code:39 ]

    Steps already taken:
    - Firebase project upgraded to Blaze (Pay-as-you-go) plan
    - App signing key SHA-1/SHA-256 (Play App Signing) added to Firebase Console
    - Upload key SHA-1/SHA-256 also added to Firebase Console
    - OAuth 2.0 Client ID (Android) manually created in Google Cloud Console, linked to the correct package name (com.washgo.mobile) and SHA-1
    - Play Integrity API enabled in Google Cloud Console
    - App Check status confirmed as "Monitoring" (not enforced, so not blocking requests)
    - SMS region policy set to "Allow" for Morocco
    - Google Play Internal Testing release published (versionCode 5), app installed via Play Store (not a development build)
    - Waited several hours between attempts to rule out temporary rate limiting

    Despite all of the above, real phone numbers (e.g. Moroccan numbers, +212...) still fail with error code 39 on every attempt, while test numbers configured in Firebase Console work without issue.

    This appears similar to reported issues:
    - https://github.com/firebase/firebase-js-sdk/issues/8955
    - https://github.com/firebase/flutterfire/issues/11565

    Could you please help us identify whether this is related to an anti-abuse mechanism blocking our project specifically, or another server-side configuration issue? We would appreciate any guidance on how to resolve this for production use.

    Thank you for your help.

    Subject: Phone Auth - Real numbers failing with error code 39 despite correct configuration (Blaze plan)

    Project ID: washgo-1582e

    We are experiencing a persistent issue with Firebase Phone Authentication on Android (React Native / @react-native-firebase/auth). Test phone numbers work correctly, but real phone numbers consistently fail.

    Error observed:
    [auth/unknown] An internal error has occurred. [ Error code:39 ]

    Steps already taken:
    - Firebase project upgraded to Blaze (Pay-as-you-go) plan
    - App signing key SHA-1/SHA-256 (Play App Signing) added to Firebase Console
    - Upload key SHA-1/SHA-256 also added to Firebase Console
    - OAuth 2.0 Client ID (Android) manually created in Google… more

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. Production Multi-Provider Integration Scheme For production readiness, for the Google IO 2027 release

    Production Multi-Provider Integration Scheme For production readiness, for the Google IO 2027 release a service that after staring into your devices camera for 20 seconds will log you into any account email platform or social media that's ever log your face and stored it in the cloud

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Firebase Auth Expose Email Verification Status and Attempts

    Firebase Auth Expose Email Verification Status and Attempts

    We have a user that is having problems verifying. However there is no logging or debugging for this feature on firebase.

    1. Add an interface under auth to see which users have requested verification
    2. Add information about if the email was recieved, spammed, blocked, expired
    3. Visually show which accounts are not validated, pending validation, and validated.
    4. Be able to reset validation, or manually validate
    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Multiple Roles

    As of now, firebase only supports single role. We want multiple role support. Example, Employer, Employee, Admin etc.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. Request to Enable Firebase Phone Authentication in Somalia.

    I am writing to request that Firebase Phone Authentication be enabled for Somalia. Over the past two years, there has been significant growth in the use of Flutter and Firebase to develop mobile apps in Somalia. However, the lack of phone authentication support in this region has created a barrier for developers.

    Phone authentication is essential for securing user accounts and is widely used in regions like ours. Enabling this feature in Somalia would greatly benefit both developers and users by improving accessibility and security.

    I kindly ask you to consider this request and enable Firebase Phone Authentication for Somalia.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

16. Admin SDK send email verification

    Currently, sending email verification is done through the client-side sdk. There is no method (to my knowledge) for sending email verification via the Admin SDK in a server environment.

    The only workaround seems to be the "generateEmailVerificationLink" function but that requires the use of a custom email service. This is different from the client-sdk functionality.

    The use case is SSR focused apps where user creation is also done via the Admin SDK and/or where support for no-js availability is a requirement.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

17. [Email Verification] Need to have a param to set expiration time

    As of now, there is no way we can set a custom expiration time for the Email Signin with link authentication. Our use case is that we generate this link through admin sdk and then mail the users (as an invite).

    Hence, it becomes really important for us to have a custom expiration time.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

18. remove recaptcha firebase phone auth flutter

    remove recaptcha firebase phone auth flutter

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

19. Expand auth blocking functions

    Support some additional data sent during the signInWithEmailAndPassword that can be read in the beforeCreate

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

20. Blocking Functions for User Reset password

    Currently you can only add blocking functions for User signup and User sign in. I want to be able to add a Blocking function for User Reset password.

    This way I can customize password requirements at the API level and implement features in Cloud functions + Firestore such as preventing previous password reuse.

    I would have used Cloud Functions + Firestore for my Blocking function, but because this feature didn't exist I ultimately decided to move my auth password checks to my AWS hosted backend API.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Authentication  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating