Description
[REQUIRED] Version info
node: n/a
firebase-functions: n/a
firebase-tools: n/a
firebase-admin: n/a
[REQUIRED] Test case
Firebase Blocking Auth functions beforeUserCreated and beforeUserSignedIn fire incorrectly when the a user that already exists in Firebase Auth attempts to register.
Function:
import { initializeApp } from "firebase-admin/app"
import {
beforeUserCreated,
beforeUserSignedIn,
} from "firebase-functions/v2/identity";
export const beforecreated = beforeUserCreated((event) => {
console.log('befoerUserCreated', event)
return;
});
export const beforesignedin = beforeUserSignedIn((event) => {
console.log('beforeUserSignedIn', event)
});
initializeApp();registerUser.js:
import { initializeApp } from "firebase/app";
import { createUserWithEmailAndPassword } from 'firebase/auth'
import { getAuth } from 'firebase/auth'
const firebaseConfig = {
apiKey: "xxx",
authDomain: "xxx.firebaseapp.com",
projectId: "xxx",
storageBucket: "xxx.appspot.com",
messagingSenderId: "xxx",
appId: "xxx"
};
// Initialize Firebase
const app = initializeApp(firebaseConfig);
const auth = getAuth(app)
const testEmail = `[email protected]`
const userCredential = await createUserWithEmailAndPassword(auth, testEmail, 'testPassword')
console.log(`ℹ️ Created test user ${userCredential.user.uid} with email ${testEmail}`)When registerUser.js is called multiple times, the beforeSignedIn and beforeUserCreated functions will fire. After the first time for the correct user creation, they will STILL FIRE, and provide random / nonexistent uid's.
This means any code that makes the assumption that these functions will only fire on authenticated sign-ins or post user-creation can potentially be exploited.
[REQUIRED] Steps to reproduce
- Deploy functions
- Run script multiple times, observe
Firebase: Error (auth/email-already-in-use). - Check logs
[REQUIRED] Expected behavior
I'd expect the functions fire as described in the documentation:
-
Before the user is created: Triggers before a new user is saved to the Firebase Authentication database, and before a token is returned to your client app.
-
Before the user is signed in: Triggers after a user's credentials are verified, but before Firebase Authentication returns an ID token to your client app. If your app uses multi-factor authentication, the function triggers after the user verifies their second factor. Note that creating a new user also triggers both these events.
[REQUIRED] Actual behavior
Blocking functions fire despite the error Firebase: Error (auth/email-already-in-use).