firebase / firebase/firebase-admin-node

getUser() return value contains passwordHash and passwordSalt

Open
#501 15 comments 5 reactions 1 assignee Claimed by @bojeil-google View on GitHub
api: auth type: bug
Dominant language
TypeScript
Stars
1.7k
Forks
419
Avg merge
3d 10h
Merged PRs (30d)
16

Description

The `UserRecord` returned by `admin.auth().getUser()` contains `passwordHash` and `passwordSalt` fields.

```
const admin = require('firebase-admin')
admin.initializeApp();
admin.auth().getUser(uid)
.then((user) => console.log(user));
```

This resulted in:

```
UserRecord {
uid: 'e1b2NmnasZXw0QtpYFcZ88IeK5t1',
email: '********@gmail.com',
emailVerified: true,
displayName: undefined,
photoURL: undefined,
phoneNumber: undefined,
disabled: false,
metadata:
UserMetadata {
creationTime: 'Wed, 03 Apr 2019 23:36:27 GMT',
lastSignInTime: 'Thu, 04 Apr 2019 00:38:10 GMT' },
providerData:
[ UserInfo {
uid: '********@gmail.com',
displayName: undefined,
email: '********@gmail.com',
photoURL: undefined,
providerId: 'password',
phoneNumber: undefined } ],
passwordHash: 'UkVEQUNURUQ=',
passwordSalt: undefined,
customClaims: undefined,
tokensValidAfterTime: 'Wed, 03 Apr 2019 23:36:27 GMT' }
```

This is contrary to the [documented behavior](https://firebase.google.com/docs/reference/admin/node/admin.auth.UserRecord#passwordHash):

> passwordHash
> (string or undefined)
>
> The user’s hashed password (base64-encoded), only if Firebase Auth hashing algorithm (SCRYPT) is used. If a different hashing algorithm had been used when uploading this user, as is typical when migrating from another Auth system, this will be an empty string. If no password is set, this is null. This is only available when the user is obtained from listUsers().

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.