firebase / firebase/firebase-admin-node

Concurrent calls to auth.createUser() may create multiple user accounts with the same email address

Open
#2,949 0 comments 7 reactions 2 assignees Claimed by @Xiaoshouzi-gh View on GitHub
api: auth
Dominant language
TypeScript
Stars
1.7k
Forks
419
Avg merge
3d 10h
Merged PRs (30d)
16

Description

### [REQUIRED] Step 2: Describe your environment

* Operating System version: macOS 14.6.1 (23G93)
* Firebase SDK version: firebase-admin@13.2.0
* Firebase Product: auth
* Node.js version: 20.18
* NPM version: 10.8.2

### [REQUIRED] Step 3: Describe the problem

Firebase does not guarantee user email uniqueness in users in case duplicate & concurrent calls are made to `auth.createUser()`, despite the "User account linking" setting in the Console being set to "Link accounts that use the same email". The API is not idempotent.

This issue breaks the promise found in the following [support documentation](https://support.google.com/firebase/answer/9134820?hl=en#:~:text=and%20sign-in-,method.,-Give%20feedback%20about):
> Users can never create multiple accounts with the same email address and sign-in method.

If calls to auth.createUser with the same email are separated enough in time (some tens of milliseconds?), the last call will raise a `auth/email-already-exists` error, which is the expected behavior.

#### Steps to reproduce:

1. Run this Firebase Admin JS script against a production Firebase environment, using node v20

```js
// `auth` is a Firebase Admin auth instance
import { auth } from "../src/admin.js";

const c = () =>
auth.createUser({
email: "thor+duplicatetest@slowby.travel",
displayName: "Test",
});

await Promise.all([c(), c()]);
```
2. Observe that two users were created with the same details, with different UIDs


Screenshot of the Firebase Console Auth dashboard

#### Workaround

Avoid concurrent calls to auth.createUser() with the same email address.

We were likely getting this issue because our front-end registration form would be submitted two times if double-clicked, which in turn lead to two concurrent `auth.createUser` calls in the back-end. Now we've debounced this call, which should avoid the issue in most circumstances.

### More context

- We are not using "Firebase Auth with Identity Platform"
- I believe this is exactly the same issue as the following issue reported for the Python Admin SDK https://github.com/firebase/firebase-admin-python/issues/809
- We saw an increase in the frequency of this issue since we started using the Firebase Admin SDK for Firebase Auth account creation (5 cases over 2 months). In the years before, when we were still using front-end Firebase JS clients for Firebase Auth account creation, we only had 1 similar case. I assume the frontend client implements some kind of debouncing internally already?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.