AmericaSCORESBayArea / AmericaSCORESBayArea/AmericaScores-CoachApp
Firebase fetchSignInMethodsForEmail is soon unsupported. Do we need it?
- 主要言語
- JavaScript
- スター
- 5
- フォーク
- 2
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
Google Firebase support calls out this method as vulnerable to an email "enumeration attack"
Is this being used for the Authenticate by Apple or Google feature? If so, we need to replace/update.
A search shows this method in two pods:
RNFBAuthModule
FirAuth
and two node modules:
auth-public
auth-credential
if it is unused, we can ignore.
----
We highly recommend enabling email enumeration protection on all your projects after testing with your app.
If you currently utilize fetchSignInMethodsForEmail (doc examples: [Java](https://notifications.google.com/g/p/ANiao5pw4C8HcWgnGPSEGOytpcO3Y3Xc6cG9OPTRpPDvgDMf1u_jHIdKsbEsrylNPl-_Yfn_uQWVO3B9V16IK7XWmBF5Yemcm9njHs9Tr820v4ZSm66iiyBUxq48l9NtuTyKoNXLu18vIu7seZVNP7FeOD58fEkusYCc1fBX1C2m3a_tFgE2XWPJvdXTyEPsuoA68rpl_0TYwgfrWVPV_91Lb9oUmGCc5TTW4_EzPKeVT_eTk7KqDCKwvgWmch5ge1VsjlYGrr4lbmWteR2QEylcht_cEK1tOFKzVgbMFTssw8SaPAXMef7BcMPQHSgmCxjxNVcPsgfBoRLyg7bxcbdn0ZzcUbM), [JS](https://notifications.google.com/g/p/ANiao5r_UdbOB5FckVLHmSA7Pqw1jQ-5YUub0w597-mIQF6HgAFgE_0iJ657lQH61nh7M7QtY-TlnfQXie2ZKMezluqH5u7ES61zsAG2ZDMVBXumMtnt0TXelvY9Rk3dHDTOf7m9cPgXJV9oeCY7DCMikTD3mjyM5EtF5Fvp58DPELnh9-ehECniwyLrdAl3dAwnZaLYlcCRnkZ4o7ih83cGQbbTwHmhn0BE7L6VT7OWgZkyOirkJJjsLFHwz_fvcmv8Hh-6uJu77LB2DRyMJ6T0IeG37vp0QQoQ15pJEg), [Swift](https://notifications.google.com/g/p/ANiao5qI0PJIkxgFocxngu22HBKFHvls4UBDK4k_miFRD8V9YrNbWBLD8J8wQQCceC68DOj-ja3DaJISkbixEOXIkhb4xTlXSy4d373Px2r-tCF1Va6HTxaLfjaM-zdVbzS3g9J5yTOgbE8AtpnjOtkKaKPwc-T7i5b9Wd0zq8taHy06a-OnQ6zzPvG2YKoexbODZ-KRCoocAADHk9s46ZS6p3di6CrNqT6PLyNvKjlYd4L-9TUwnNHVei_Rg_T--KBZ6HTq_uFnsZQcSNfB8Ctb8jeYWuFa6kZkfRr23g_Si66OHpOccXpM-38V7-iAs8XysvY)), your projects will be affected. When email enumeration is enabled, the fetchSignInForEmail API will fail. Linking anonymous authenticated users with an email address will also not work prior to SDK version 22.3.0 for Android, 10.18.0 for iOS, and 10.6.0 for Web.
A [full list](https://notifications.google.com/g/p/ANiao5qJdbW39dS9C12HwylXnYO6k7RE9m9sqOrVFrxXe2wqCA6FC4QS7DSPh-1jCVNXIB6CYg-DdIFbxreL4CKQLp3CH8CDGntva05ORYemKtgjuXNAxlux2zQGfTPaFX8Wte7cOUkhFfKQRCanefqrmyvvK2UgUHeA658qauoZ_6XHtXddmrOZGqE0G4qFaLqaiDBpql62RAGSeVtjMhMBW1HoNGYCVAtmWZGJe9DuH7UFcmOTxUFOy1xBPN-zn45HRSdY2polFtriZI0XXG3cBZMJzO-IlXVhVQ) of affected flows is also available for review.
Additionally, FirebaseUI libraries first run fetchSignInMethodsForEmail before allowing a user to sign in with their preferred method. If you have a dependency on the library, you should evaluate impact before enabling email enumeration detection. Once FirebaseUI libraries are updated ([issue 1](https://notifications.google.com/g/p/ANiao5qgZHLJnY-3QGFtxrO9QQWGJ6xH5eQ1NoFzewzS5SXWG10f5ryg5JG5vFXKDdDni_yg3Au2RD5XC3HIkSN2CEa9M16-wC-APN86ge7egQm80EtFTYLIzuT_u6Prc31j-W54n2ns18zx5K5dGZtuuW9Anc_nbgyGquKpVTjvkYgvbkXfeWnYLSSGLy8lkdIgmcun1IfGvD7Z4duGtAFf2Nl602qAfsjrwzKwYSO_7krFd9Bz), [issue 2](https://notifications.google.com/g/p/ANiao5p_YgUyUHQ4laMrY0ffdF4SjugAvU7WshvcU3B6W6jEuDVySQ0b_cDB4fNicLrnTuMpEVf34mffWOx9ekSLuWlPjYqMc350SuKF3uLS7uyv8YDoaYCIyIjzgcGFz9l0ixRLKVGgpHUCb-Si7IP06e_3wQRrAdGmapounyu-NfFrUrvwc0RtRtkYJZUAHSh2NW4WbzkLpy92iJLBFml_HYLy6vlWHiKR645Mdf3a5fk2xzOB), [issue 3](https://notifications.google.com/g/p/ANiao5qog8qX8KVVjGKqTTps6czGw1lrB3-MDxaW7pwqNrZQKaaClNPfJH24NKc3n-miVK-JYVhbYRl3sn1umLw10slmp1lTfm0JJ0F1LJnGkCVoxwoyFRhehgqdGKdsineRacz-KBuwscqO7BEZkWoNUnsIOI4XnExkfkqrITaLsa7rygxsutGcoih84N5lMDI7YxKLhbekIeWGI2EmeuYQRvVANAbFrZ4uFC73-mT4fZDsoCaZL6UM7Q), [issue 4](https://notifications.google.com/g/p/ANiao5o1VuBWT2HV2etxa2zESj8hFdiCkFm7cRzfDza0LGg-akDkzRjdiQKV6kW1NmvEtfQNIo785HX3CWUUYIwnI-MuVRkHUJe4HDK_6dd0KsF1etf0rFr8LueIzq64kuoGKKtm6Fscims55rQqJQPuU70GDxoC6UvibABXw3LHLANvVhG56dS1P1v6r-vooTRK-vPinsIxkVRWVjB5oH2PzHdttWDFydG5pNelinvEQrtJmXbs)), you should enable email enumeration protection.
One or more of your projects have Firebase Auth or Google Cloud Identity Platform enabled.
We’re here to help
If you have any additional questions, please look through our [documentation center](https://notifications.google.com/g/p/ANiao5qzzYXR9WR-vBWDXqaRu2rCyupc8Kl70k3moOVjKrgZyRJY1wVMdU4H2VAtWhAeNuXrdTc4h8t0zcFWdhb_Co-GSyMKJvAmQQ01polGey4SojHgnnDiWHd9mMnzo8-fV9m1VSbF1-zMSC4G3HPPRCoaAnTR9fH5TSq_ockYTV6qNwPrDKDN0DRE1AdYQbN4LfhXeVfUw-HXbZjr7VlNK5WGeCr3HG6VGhtaUbg).
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。