firebaseui-web
firebaseui-web copied to clipboard
Unable to login with email + password if "email enumeration protection" is enabled
[REQUIRED] Describe your environment
- Operating System version: MacOS 11.6.8
- Browser version: Chrome Version 116.0.5845.110 (Official Build) (x86_64)
- Firebase UI version: 6.1.0
- Firebase SDK version: 9.12.1
[REQUIRED] Describe the problem
I've been going through the official Firebase Security Checklist (https://firebase.google.com/support/guides/security-checklist), and since I use email-password auth I followed the instructions to enable email enumeration protection. After enabling enumeration protection, all login attempts result in the message "Not Authorized: [email] is not authorized to view the requested page" immediately after inputing the user email and pressing the "NEXT" button — no password input field is presented. Disabling enumeration protection returns normal login functionality.
Steps to reproduce:
- Enable email enumeration protection
- Follow the instructions at https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection to enable improved email privacy
- Try to login
Relevant Code:
N/A — I expect that any app configured for email-password auth will encounter the issue
Expected behavior:
FirebaseUI can be used to authenticate with firebase instances that have enabled email enumeration protection, as suggested by the official Firebase Security Checklist