firebaseui-web icon indicating copy to clipboard operation
firebaseui-web copied to clipboard

Unable to login with email + password if "email enumeration protection" is enabled

Open studiomomo-bss opened this issue 11 months ago • 7 comments

[REQUIRED] Describe your environment

  • Operating System version: MacOS 11.6.8
  • Browser version: Chrome Version 116.0.5845.110 (Official Build) (x86_64)
  • Firebase UI version: 6.1.0
  • Firebase SDK version: 9.12.1

[REQUIRED] Describe the problem

I've been going through the official Firebase Security Checklist (https://firebase.google.com/support/guides/security-checklist), and since I use email-password auth I followed the instructions to enable email enumeration protection. After enabling enumeration protection, all login attempts result in the message "Not Authorized: [email] is not authorized to view the requested page" immediately after inputing the user email and pressing the "NEXT" button — no password input field is presented. Disabling enumeration protection returns normal login functionality.

Steps to reproduce:

  1. Enable email enumeration protection
    • Follow the instructions at https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection to enable improved email privacy
  2. Try to login

Relevant Code:

N/A — I expect that any app configured for email-password auth will encounter the issue

Expected behavior:

FirebaseUI can be used to authenticate with firebase instances that have enabled email enumeration protection, as suggested by the official Firebase Security Checklist

studiomomo-bss avatar Sep 19 '23 01:09 studiomomo-bss