Skip to content

docs(auth): clarify behavior of password reset email with email enumeration protection enabled #18296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SelaseKay wants to merge 1 commit into
base: main
Choose a base branch
from
+17 −3
Open

docs(auth): clarify behavior of password reset email with email enumeration protection enabled #18296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/auth/manage-users.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,11 @@ await FirebaseAuth.instance
.sendPasswordResetEmail(email: "user@example.com");
```

Note: If
[email enumeration protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection)
is enabled for your Firebase project, `sendPasswordResetEmail()` may complete
without throwing an error even when the email address is not registered. This is
expected Firebase Auth behavior to prevent revealing whether an email exists.
You can customize the email template that is used in Authentication section of
the [Firebase console](https://console.firebase.google.com/), on the Email Templates page.
See [Email Templates](https://support.google.com/firebase/answer/7000714) in
Expand Down
7 changes: 6 additions & 1 deletion packages/firebase_auth/firebase_auth/lib/src/firebase_auth.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,10 @@ class FirebaseAuth extends FirebasePluginPlatform implements FirebaseService {
/// To complete the password reset, call [confirmPasswordReset] with the code supplied
/// in the email sent to the user, along with the new password specified by the user.
///
/// If email enumeration protection is enabled for the Firebase project, this
/// method may complete successfully even when the email does not correspond
/// to an existing user.
///
/// May throw a [FirebaseAuthException] with the following error codes:
///
/// - **auth/invalid-email**\
Expand All @@ -312,7 +316,8 @@ class FirebaseAuth extends FirebasePluginPlatform implements FirebaseService {
/// - **auth/unauthorized-continue-uri**\
/// The domain of the continue URL is not whitelisted. Whitelist the domain in the Firebase console.
/// - **auth/user-not-found**\
/// Thrown if there is no user corresponding to the email address. Note: This exception is no longer thrown when enabling email enumeration protection.
/// Thrown if there is no user corresponding to the email address. Note: This
/// exception is not thrown when email enumeration protection is enabled.
Future<void> sendPasswordResetEmail({
required String email,
ActionCodeSettings? actionCodeSettings,
Expand Down
8 changes: 6 additions & 2 deletions ..._auth_platform_interface/lib/src/platform_interface/platform_interface_firebase_auth.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,8 +313,12 @@ abstract class FirebaseAuthPlatform extends PlatformInterface {
}

/// Triggers the Firebase Authentication backend to send a password-reset
/// email to the given email address, which must correspond to an existing
/// user of your app.
/// email to the given email address.
///
/// If email enumeration protection is enabled for the Firebase project, this
/// method may complete successfully even when the email does not correspond
/// to an existing user. This prevents apps from using password reset requests
/// to discover registered email addresses.
Future<void> sendPasswordResetEmail(
String email, [
ActionCodeSettings? actionCodeSettings,
Expand Down
Loading