CODEWITHSUNDEEP
firebase-authenticationemail-validationreset-password
Tayyab Mazhar
Tayyab Mazhar

Reputation: 1702

Forget password for Firebase Authentication with invalid email address

Firebase's email/password signup doesn't check if an email is valid - user can create an account with an email like [email protected] even if that email doesn't exist on google.

The issue is that if, a user forgets their password and we send a password reset email to that invalid email, the user wont be able to reset their password.

How to get around this issue?

Upvotes: 0

Views: 220

Answers (1)

Frank van Puffelen
Frank van Puffelen

Reputation: 599101

If you stick to using email+password authentication, there isn't really a good way to handle the scenario. Technically, you can change the password through the Admin SDK. But the problem is that you have no way to verify that the user is really the owner of the account, so you might be handing the new password to a malicious user.

If you want the user to only be able to sign in after their email address has been verified, consider using email link authentication.

Upvotes: 1

Related Questions