firebase / firebase/firebase-admin-node

Concurrent calls to auth.createUser() may create multiple user accounts with the same email address

Đang mở
#2,949 0 bình luận 7 reaction 2 người được giao Được @Xiaoshouzi-gh nhận Xem trên GitHub
api: auth
Ngôn ngữ chính
TypeScript
Star
1.7k
Fork
419
Merge trung bình
3 ngày 10 giờ
Pull request đã merge (30 ngày)
16

Mô tả

### [REQUIRED] Step 2: Describe your environment

* Operating System version: macOS 14.6.1 (23G93)
* Firebase SDK version: firebase-admin@13.2.0
* Firebase Product: auth
* Node.js version: 20.18
* NPM version: 10.8.2

### [REQUIRED] Step 3: Describe the problem

Firebase does not guarantee user email uniqueness in users in case duplicate & concurrent calls are made to `auth.createUser()`, despite the "User account linking" setting in the Console being set to "Link accounts that use the same email". The API is not idempotent.

This issue breaks the promise found in the following [support documentation](https://support.google.com/firebase/answer/9134820?hl=en#:~:text=and%20sign-in-,method.,-Give%20feedback%20about):
> Users can never create multiple accounts with the same email address and sign-in method.

If calls to auth.createUser with the same email are separated enough in time (some tens of milliseconds?), the last call will raise a `auth/email-already-exists` error, which is the expected behavior.

#### Steps to reproduce:

1. Run this Firebase Admin JS script against a production Firebase environment, using node v20

```js
// `auth` is a Firebase Admin auth instance
import { auth } from "../src/admin.js";

const c = () =>
auth.createUser({
email: "thor+duplicatetest@slowby.travel",
displayName: "Test",
});

await Promise.all([c(), c()]);
```
2. Observe that two users were created with the same details, with different UIDs


Screenshot of the Firebase Console Auth dashboard

#### Workaround

Avoid concurrent calls to auth.createUser() with the same email address.

We were likely getting this issue because our front-end registration form would be submitted two times if double-clicked, which in turn lead to two concurrent `auth.createUser` calls in the back-end. Now we've debounced this call, which should avoid the issue in most circumstances.

### More context

- We are not using "Firebase Auth with Identity Platform"
- I believe this is exactly the same issue as the following issue reported for the Python Admin SDK https://github.com/firebase/firebase-admin-python/issues/809
- We saw an increase in the frequency of this issue since we started using the Firebase Admin SDK for Firebase Auth account creation (5 cases over 2 months). In the years before, when we were still using front-end Firebase JS clients for Firebase Auth account creation, we only had 1 similar case. I assume the frontend client implements some kind of debouncing internally already?

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.