We are using Firebase on our project and we want only users who recieved an email invitation to be able to access register page and create a profile afterwards.
Can you do that using firebase?
There is nothing built into Firebase Authentication to allow only users you've invited to sign up. When the email+password provider is enabled, anyone can call the API and register.
What you can do though is have a list of the invited email addresses in an online database somewhere (such as Firebase's Realtime Database of Firestore) and check against that list whether a user is authorized after they have signed in.
For an example of how to limit access to the database to specific users, have a look at:
for Realtime Database: How do I lock down Firebase Database to any user from a specific (email) domain?
for Firestore: Restrict Firestore gmail sign in to specific domain
Related
I am currently using firebase to make an ionic app. I am using firebase simple login for social auth (facebook, twitter, email & password). The auth works perfectly, it $broadcasts the authed user. However it doesn't seem to create a user in the actual firebase db. I was wondering how I can get the users that have been authed using my app.
For most of the authentication protocols it supports, Firebase doesn't store user data anywhere. Even for the protocols where it does store data (I only know of email+password doing this), it stores this information in a place that your application can't access (though you can find those users in the dashboard of your Firebase).
To quote the Firebase documentation:
It does not store profile or user state in your Firebase. To persist user data you must save it to your Firebase.
What most applications end up doing, is keeping a list of users inside their Firebase that they manage themselves. So when a user first authenticates with the application, it creates a node under /users/<uid> that contains the information for that user.
See this section of the Firebase documentation that describes storing user data.
Firebase does not store profile or user state in your Firebase instance. To persist user data you must save it to your Firebase.
Firebase provides multiple authentications services
Using existing social login providers such Facebook, Twitter, Google, and GitHub. Using these services provides an option for your users to access your application without creating a new account.
Using built-in support for logging in with email & password. This requires registration and account creation that is handled by Firebase. The user account information is stored outside you application.
Using a custom authentication to implement existing server-side authentication, single sign-on, legacy systems, or third-party OAuth based services (such as Yahoo).
Once authenticated, Firebase return a variable auth to your application that you can use for authorization and access control. This variable is null for unauthenticated users, but for authenticated users it is an object containing the user's unique (auth.uid) and potentially other data about the user.
If you want to persist additional user information such as name
and location, then you need to use auth.uid and store it in your
Firebase with additional profile data.
Internally, Firebase generates JSON Web Tokens (JWTs) and creates authenticated sessions by calling Firebase.loginWithCustomToken() with those tokens. Each user is assigned a uid (a unique ID), which is guaranteed to be distinct across all providers, and to never change for a specific authenticated user.
The user data for firebase authentication is stored in firebaseLocalStorageDb in IndexedDB. After login to website, if you delete firebaseLocalStorageDb, the login user data for firebase authentication is all deleted so you need to log in website again.
I wonder if it is possible to retrieve a user details only using it's UID, I want it because I want to show my users their list of friends, I have checked the documentation on Firebase Auth., It seems to be only supported in 'admin' section. Should I save my user data in the database instead of Auth. or Is there a way to do it without using Firebase Auth. in my server ? I am running a web application and using Javascript to manipulate data.
There is no API to list or query Firebase Auth accounts directly from a web or mobile app. That would be a security problem, and that's why it's limited to admin/backend access only via the Firebase Admin SDK.
If you do want anyone to be able to find other user accounts, you will need to store that user data in your database, or provide a backend API endpoint that it can access.
I'm working on a web application which uses React and Firebase as backend.
This application shows a list of users and, for each user, I wanna know if his email has been verified.
So,
How can I check if an user's email (given an email address) has been verified ?
I already tried to do som :
firebase.auth().getUserByEmail(email).then((info)=>{
console.log("sucessfully fetched info:" +info);
})
.catch(()=>console.log("error")
But I got error, something like 'getUserByEmail is not a function'
Firebase Auth does not provide any APIs for a user to get any other user's profile data. That would be a security problem - profile data is private in Firebase Auth.
What you'll have to do is write some code that updates a database with the information you want, and have your clients query that database instead. How this happens in practice is entirely up to you. Each user account is probably going to have to update the database with its own email verification status.
I am trying to use a 6 digit code to log-in a user.
The code is available for 20 seconds and is unique to every user.
Briefly explained:
User is already logged in on a mobile app
User press the button "Get Unique Code"
Then, user enter the code on a WebPage on his PC
If the code is correct, show data for that user
What am I asking is if there is way to properly authenticate the user who introduces that code correctly given that I have the userID and all the informations about the user?
I can try and "fake log-in" (display all the information for that user when the code is correct) but there are some issues with this and I would like to avoid it.
I am using Firebase Authentication and Firebase Firestore. JavaScript is used for Web.
You can implement any authentication scheme you want by creating a custom provider for Firebase Authentication.
See Authenticate with Firebase in JavaScript Using a Custom Authentication System and Creating Custom Tokens with the Admin SDK.
In this flow you:
Sign in the users yourself.
Create a custom token for those users in a trusted environment, such as a server you control, or Cloud Functions.
Pass that custom token to Firebase Authentication, which can then use it to identify the user, and secure access to Firestore, Storage, and Realtime Database.
I am using the Facebook login as an authentication for my PhoneGap application - once a user logs in, their data is retrieved from my database to display information. I am not using the SDK for any other purpose.
I have the Facebook auto login working fine - it retrieves an authResponse and my Facebook information. Since the access token changes with each login, what can I use to store locally and in my database to authenticate the user on my server for future logins?
Here is a flow that I think could work...
User sees logs in screen and enters Facebook credentials
Facebook securely validates and returns user information & access token
The app uses localStorage to store user email and access token
For future autologin, the localStorage values are used as email/password
I feel like this cannot be the correct answer, however.
I figured out a solution - I was confused about storing passwords on my database to fetch user information. Rather, these are the correct steps:
Use Facebook SDK to handle the login and retrieve the authResponse
Update the user table in my database with the temporary access token and retrieve user's information
For every POST or GET the user wishes to perform, I will match the FB.getLoginStatus() results from the database's access token (the check will be done server side)
If the tokens match, perform requests. Otherwise, force the user to login again.