FirebaseUI always try to create a new account also if email exists in Firebase Auth #1040

ralf00 · 2023-09-15T16:13:24Z

Hello,

i'm using firebase ui 10 on my nodejs project, implementing it in react (supported by this video https://www.youtube.com/watch?v=eTuJ47RvEdQ

everything seems to work good but with one big problem, if i insert the email address of a already existent user, it goes forward asking me to "Create a new account" and "Choose a new password" that is not what is expected.

If i put a password it goes on error telling me that the email address already exists and asking me to reset the password.

Anyone has encountered this issue? some advice?

anisabboud · 2023-09-15T22:10:44Z

I'm encountering the same issue on a new project with AngularFire + FirebaseUI (cannot Sign in with Email):

Sign up with some [email protected]
Check Firebase console - everything is fine.
Sign out
Try to sign in again using same [email protected]
It shows the Create account UI again instead of the Sign in UI even though the account exists for this email!
If you try to Sign up again, you get an error:
This email already exists without any means of sign-in. Please reset the password to recover.

I compared the network tab in this project compared to an older project:

Old project (works fine), network tab after inputting the email and clicking Next (correctly identifies that the user exists):
New project (cannot sign in), network tab after inputting the email and clicking Next (response indicates user doesn't exist):

Versions:

    "@angular/fire": "^7.6.1",
    "firebase": "^9.23.0",
    "firebaseui": "^6.1.0",
    "firebaseui-angular": "^6.1.3",

ralf00 · 2023-09-16T07:28:48Z

I'm encountering the same issue on a new project with AngularFire + FirebaseUI (cannot Sign in with Email):

Sign up with some [email protected]

Check Firebase console - everything is fine.

Sign out

Try to sign in again using same [email protected]

It shows the Create account UI again instead of the Sign in UI even though the account exists for this email!

If you try to Sign up again, you get an error:
This email already exists without any means of sign-in. Please reset the password to recover.

I compared the network tab in this project compared to an older project:

Old project (works fine), network tab after inputting the email and clicking Next (correctly identifies that the user exists):

New project (cannot sign in), network tab after inputting the email and clicking Next (response indicates user doesn't exist):

Versions:
    "@angular/fire": "^7.6.1",
    "firebase": "^9.23.0",
    "firebaseui": "^6.1.0",
    "firebaseui-angular": "^6.1.3",

Exactly like me... i did the same things using Network, looking at the Console but nothing found.

Do you suggesto to do a downgrade? Which version is a working version?

anisabboud · 2023-09-16T08:37:11Z

Tried downgrading from 6.1.0 to 6.0.0, but it didn't help.
The culprit seems to be in fetchSignInMethodsForEmail used by FirebaseUI to determine whether to show Sign in / Create account flow:

firebaseui-web/javascript/widgets/authui.js

Line 1174 in 85fbdd4

p = this.getAuth().fetchSignInMethodsForEmail(email)

For some reason, it's returning [] instead of ['password'] on the new project, but it works fine on an old project!

import { getAuth, fetchSignInMethodsForEmail } from 'firebase/auth';  // or from '@angular/fire/auth';

  constructor() {
    fetchSignInMethodsForEmail(getAuth(), '[email protected]').then(console.log);  // prints [] instead of ['password']
  }

Related iOS issue: firebase/firebase-ios-sdk#11810

anisabboud · 2023-09-16T08:49:53Z

Related: https://stackoverflow.com/questions/77115477/reactjs-and-firebase-ui-authentication-problems
(same issue posted 11 hours ago). Quoting from Stack Overflow:

When I use email/password to log in, I enter my email, it prompts me to create an account by entering a password, I do that and get logged in. I also receive a verification email, which works. The problem is that if I log out and then try to log back in with the same credentials, it essentially prompts me to create a new user by entering a new password. If I try to proceed, it says the email already exists, and I can reset the password.

gdutleung · 2023-09-16T15:58:26Z

I got the same issue!!!
my version is

 "firebase": "^10.3.1",
  "firebaseui": "^6.1.0",

Is there any way to fix this issue or any old verison I can use to avoid this issue? Thankyou very much!

donaldr · 2023-09-22T20:22:41Z

Is there no resolution for this? Or should I just no use Firebase? Seems like a pretty egregious bug.

ralf00 · 2023-09-22T20:50:06Z

For now i solved without using Firebase UI for authentication but just using Firebase with custom email and password fields that works. The problem is just with Firebase UI.. waiting for resolution...

arupnayak · 2023-09-26T14:03:27Z

i am facing the same issue with new firebase project. works fine on old project

sgb-io · 2023-10-04T14:30:24Z

Also facing this.

FYI: this appears to be a Google issue (see comments from @paulb777): firebase/firebase-ios-sdk#11810 (comment)

No apparent fix available yet.

robmr88 · 2023-10-04T20:02:26Z

I am having the same problem, I am having it on Firebase Ui Android native, and Firebase UI Flutter

sgb-io · 2023-10-05T18:50:39Z

It looks like this is a breaking change for email/password sign-in due to the Email Enumeration Protection changes in Firebase. This feature is enabled by default as of 15 September 2023.

Unfortunately, it seems this project (Firebase UI) is seemingly abandoned by Google, so you either need to roll your own email/password sign-in solution against the Firebase SDKs or look at alternative projects.

It's not the best developer experience: you follow the Firebase docs to get started, Firebase UI is prominently recommended, then you later find out that it doesn't fully work and they've stopped maintaining it (with no obvious alternative available). Maybe they will swap to giving examples of how to roll your own; that would be better than starting your project then later realising you need to take multiple steps backward.

victorcastro89 · 2023-10-20T04:07:34Z

It is a backend issue, you can just disable email-enumeraion-protection as work around:
https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#disable

naturedamends · 2023-10-22T08:08:45Z

It is a backend issue, you can just disable email-enumeraion-protection as work around: https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#disable

How can I run this? When adding it to top level module of my firebase functions It won't analyse.

EDIT: figured it out - you can run the command in the GCP terminal to get the accees token.

jhuleatt · 2023-10-23T18:38:12Z

As @sgb-io and @victorcastro89 noted, this is due to a change in defaults for Firebase Authentication. On September 15, 2023 email enumeration protection was enabled by default for all new Firebase projects created after that date to boost security. When this setting is enabled, it limits the ability to check for what existing sign in methods exist for an email address through the fetchSignInMethodsForEmail JavaScript API, which FirebaseUI uses to decide whether to show the "Sign In" screen or "Create Account" screen.

We're going to update FirebaseUI to take away this conditional behavior. Until we do that, unfortunately the only workaround is to disable email enumeration protection on your Firebase project's underlying Cloud project. Related issue: firebase/firebase-js-sdk#7644 (comment)

capodisseny · 2023-11-14T11:25:28Z

Also could fix it with the curl command from the terminal.
PROJECT_ID = firebase project id

First get the ACCESS_TOKEN
$ gcloud auth print-access-token --project=PROJECT_ID

Now replace ACCESS_TOKEN and PROJCT_ID
`$ curl -X PATCH -d "{'email_privacy_config':{'enable_improved_email_privacy':"false"}}"
-H 'Authorization: Bearer ACCESS_TOKEN'
-H 'Content-Type: application/json' -H 'X-Goog-User-Project: PROJECT_ID'
"https://identitytoolkit.googleapis.com/admin/v2/projects/PROJECT_ID/config?updateMask=email_privacy_config"

`

blalmal10a · 2024-01-12T15:34:20Z

As @sgb-io and @victorcastro89 noted, this is due to a change in defaults for Firebase Authentication. On September 15, 2023 email enumeration protection was enabled by default for all new Firebase projects created after that date to boost security. When this setting is enabled, it limits the ability to check for what existing sign in methods exist for an email address through the fetchSignInMethodsForEmail JavaScript API, which FirebaseUI uses to decide whether to show the "Sign In" screen or "Create Account" screen.

We're going to update FirebaseUI to take away this conditional behavior. Until we do that, unfortunately the only workaround is to disable email enumeration protection on your Firebase project's underlying Cloud project. Related issue: firebase/firebase-js-sdk#7644 (comment)

Please mark this as answer for others can easily find the temporary solution @ralf00

UtkarshSaxenautk · 2024-01-29T08:26:47Z

@ralf00 Try turning off email enumerations from auth-setting in your account.

danielramdometic · 2024-02-04T22:30:00Z

It is a backend issue, you can just disable email-enumeraion-protection as work around: https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#disable

I don't know how you figured this out, but thank you a lot.

coleridge72 · 2024-02-07T20:02:42Z

We're going to update FirebaseUI to take away this conditional behavior. Until we do that, unfortunately the only workaround is to disable email enumeration protection on your Firebase project's underlying Cloud project. Related issue: firebase/firebase-js-sdk#7644 (comment)

Hi @jhuleatt, thanks for the workaround - any word on when the official fix will be up?

Boardtale · 2024-02-10T12:10:12Z

Adding my +1 here. Would love to see insta sign in (not checking if account exist on first try)

vkmel · 2024-02-29T20:03:12Z

+1 .. no fix yet.

benlabbeus · 2024-03-07T00:04:24Z

+1

patricebender · 2024-03-07T11:49:09Z

+1

theangrydev · 2024-03-10T03:03:56Z

+1

sharafeddeen · 2024-03-11T17:24:35Z

Disabling email enumeration protection on the firebase console worked for me.

Not cool having to patch up my project with workarounds, but at least it's something until they release an official fix.

kodejuice · 2024-03-12T14:16:11Z

Disabling email enumeration protection on the firebase console worked for me.

Not cool having to patch up my project with workarounds, but at least it's something until they release an official fix.

This also fixed it for me

jacobakkerboom · 2024-04-03T10:35:50Z

As @sgb-io and @victorcastro89 noted, this is due to a change in defaults for Firebase Authentication. On September 15, 2023 email enumeration protection was enabled by default for all new Firebase projects created after that date to boost security. When this setting is enabled, it limits the ability to check for what existing sign in methods exist for an email address through the fetchSignInMethodsForEmail JavaScript API, which FirebaseUI uses to decide whether to show the "Sign In" screen or "Create Account" screen.

We're going to update FirebaseUI to take away this conditional behavior. Until we do that, unfortunately the only workaround is to disable email enumeration protection on your Firebase project's underlying Cloud project. Related issue: firebase/firebase-js-sdk#7644 (comment)

A little comment about this in the README would go a long way I think (until it's fixed). I wanted to try out firebase (and nextjs) and I made a test app using nextjs, then another one using node/express just to make sure I didn't mess up the nextjs stuff, then I looked in the FirebaseUI README to see if maybe I'm supposed to change the configuration, all to no avail. It's hard to guess that such an official resource like FirebaseUI would have an issue in what is basically its "hello world", and without guessing that there's something wrong with it it's hard to find answers pointing to the new setting.

mdemund-scpr · 2024-04-12T19:36:05Z

+1

JosefJezek · 2024-04-29T07:56:55Z

any progress?

g-stone7 · 2024-05-02T20:24:29Z

+1

any626 · 2024-05-10T06:57:16Z

Any updates?

VektorTech · 2024-05-13T00:56:58Z

+1

sanjulaonline · 2024-05-16T11:19:49Z

+1

mbimbij · 2024-05-18T19:26:42Z

"egregious bug", couldn't agree more. A "drop-in solution" should at least allow you to setup a working proof of concept out of the box with default config. And it is still not fixed 8 months after the issue is opened, what a shame.

kyrylo-drlg · 2024-05-31T08:26:41Z

+1 works for me disable email protection

leknesh · 2024-07-10T16:21:38Z

Disabling email protection in the Firebase project does NOT work for me. Any more workaround suggestions?

joe-brutto-66degrees · 2024-08-05T16:36:32Z

+1 still not fixed even with the GIP+IAP "Use an existing hosted sign-in page"
However; the workaround for the Firebase project did work for me.

hnphi · 2024-08-23T03:26:11Z

+1
Not work when enabling email protection. But, if disable protection is then face the issue that users use the same email that they already logged in by Google/Microsoft

KateGoncharik · 2024-09-21T18:02:11Z

Still not fixed..
this helped: https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#disable

RobinsonMichael-FS · 2024-09-30T05:47:00Z

+1
It's been over a year now.

kelvinkoko · 2024-10-10T13:47:27Z

Disable email protection workaround work, thanks for sharing. But as other mentioned, suppose it is drop in solution and i seems don't see it is deprecated, would like to +1 on this issue. I still love the convenience of firebase but having this bug in this common flow for a year really hurt developer experience.

anisabboud mentioned this issue Sep 16, 2023

fetchSignInMethodsForEmail returning nil when email has providers associated. firebase/firebase-ios-sdk#11810

Closed

jhuleatt pinned this issue Oct 23, 2023

simonness mentioned this issue Jan 29, 2024

Project appears to be dead #1015

Open

GiorgioCampea mentioned this issue Apr 7, 2024

USER02 - Allow a User to register and login to the application gdgpescara/hedwig#167

Closed

GiorgioCampea mentioned this issue Apr 15, 2024

USER02 - Allow a User to register and login to the application gdgpescara/hedwig#169

Merged

FirebaseUI always try to create a new account also if email exists in Firebase Auth #1040

FirebaseUI always try to create a new account also if email exists in Firebase Auth #1040

Comments

ralf00 commented Sep 15, 2023

anisabboud commented Sep 15, 2023 • edited Loading

ralf00 commented Sep 16, 2023

anisabboud commented Sep 16, 2023 • edited Loading

anisabboud commented Sep 16, 2023

gdutleung commented Sep 16, 2023

donaldr commented Sep 22, 2023

ralf00 commented Sep 22, 2023

arupnayak commented Sep 26, 2023

sgb-io commented Oct 4, 2023

robmr88 commented Oct 4, 2023

sgb-io commented Oct 5, 2023 • edited Loading

victorcastro89 commented Oct 20, 2023

naturedamends commented Oct 22, 2023 • edited Loading

jhuleatt commented Oct 23, 2023 • edited Loading

capodisseny commented Nov 14, 2023

blalmal10a commented Jan 12, 2024

UtkarshSaxenautk commented Jan 29, 2024

danielramdometic commented Feb 4, 2024

coleridge72 commented Feb 7, 2024

Boardtale commented Feb 10, 2024

vkmel commented Feb 29, 2024

benlabbeus commented Mar 7, 2024

patricebender commented Mar 7, 2024

theangrydev commented Mar 10, 2024

sharafeddeen commented Mar 11, 2024

kodejuice commented Mar 12, 2024

jacobakkerboom commented Apr 3, 2024

mdemund-scpr commented Apr 12, 2024

JosefJezek commented Apr 29, 2024

g-stone7 commented May 2, 2024

any626 commented May 10, 2024

VektorTech commented May 13, 2024

sanjulaonline commented May 16, 2024

mbimbij commented May 18, 2024 • edited Loading

kyrylo-drlg commented May 31, 2024 • edited Loading

leknesh commented Jul 10, 2024

joe-brutto-66degrees commented Aug 5, 2024

hnphi commented Aug 23, 2024

KateGoncharik commented Sep 21, 2024 • edited Loading

RobinsonMichael-FS commented Sep 30, 2024

kelvinkoko commented Oct 10, 2024 • edited Loading

anisabboud commented Sep 15, 2023 •

edited

Loading

anisabboud commented Sep 16, 2023 •

edited

Loading

sgb-io commented Oct 5, 2023 •

edited

Loading

naturedamends commented Oct 22, 2023 •

edited

Loading

jhuleatt commented Oct 23, 2023 •

edited

Loading

mbimbij commented May 18, 2024 •

edited

Loading

kyrylo-drlg commented May 31, 2024 •

edited

Loading

KateGoncharik commented Sep 21, 2024 •

edited

Loading

kelvinkoko commented Oct 10, 2024 •

edited

Loading