firebase / firebase/firebase-js-sdk
updatePhoneNumber and verifyBeforeUpdateEmail methods not working on a user who has MFA enabled, same as enrolling to mfa existing phone number
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### Describe your environment
*Operating System version: macOS Catalina v.10.15.4
*Browser version: Chrome Version 83.0.4103.106 (Official Build) (64-bit)
*Firebase SDK version: "firebase": "^7.15.1"
*Firebase Product: auth mfa
### Describe the problem
1) If the user has MFA enrolled, verifyBeforeUpdateEmail will throw: https://www.googleapis.com/identitytoolkit/v3/relyingparty/getOobConfirmationCode?key=***
```
{
"error": {
"code": 400,
"message": "CREDENTIAL_TOO_OLD_LOGIN_AGAIN",
"errors": [
{
"message": "CREDENTIAL_TOO_OLD_LOGIN_AGAIN",
"domain": "global",
"reason": "invalid"
}
]
}
}
```
But the user was just relogged, because previous step throws error: 'auth/requires-recent-login' and that logic is on the place.
2) updatePhoneNumber will throw this error on mfa enrolled user:
https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyPhoneNumber?key=***
```
{
"error": {
"code": 400,
"message": "UNSUPPORTED_FIRST_FACTOR : The account has MFA enabled, please sign-in with MFA eligible first factor.",
"errors": [
{
"message": "UNSUPPORTED_FIRST_FACTOR : The account has MFA enabled, please sign-in with MFA eligible first factor.",
"domain": "global",
"reason": "invalid"
}
]
}
}
```
3) If you have no factors enrolled and use updatePhoneNumber on number XXXXX, MFA enrollment wont let you use this factor to add MFA
Everything works perfectly fine in same project with user who has zero MFA factors enrolled.
#### Steps to reproduce:
Basically create user with MFA factor enrolled and try 2 methods as documented in firebase updatePhoneNumber and verifyBeforeUpdateEmail, then you can try to update user phone who has no enrollment in mfa and try to use same number to add mfa to get number 3 issues.
Contributor guide
Assessment
This issue has not been assessed yet.