firebase / firebase/firebase-js-sdk

updatePhoneNumber and verifyBeforeUpdateEmail methods not working on a user who has MFA enabled, same as enrolling to mfa existing phone number

Open
#3,247 5 comments 2 reactions 0 assignees View on GitHub
api: auth needs-attention question
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Describe your environment

*Operating System version: macOS Catalina v.10.15.4
*Browser version: Chrome Version 83.0.4103.106 (Official Build) (64-bit)
*Firebase SDK version: "firebase": "^7.15.1"
*Firebase Product: auth mfa

### Describe the problem
1) If the user has MFA enrolled, verifyBeforeUpdateEmail will throw: https://www.googleapis.com/identitytoolkit/v3/relyingparty/getOobConfirmationCode?key=***
```
{
"error": {
"code": 400,
"message": "CREDENTIAL_TOO_OLD_LOGIN_AGAIN",
"errors": [
{
"message": "CREDENTIAL_TOO_OLD_LOGIN_AGAIN",
"domain": "global",
"reason": "invalid"
}
]
}
}
```
But the user was just relogged, because previous step throws error: 'auth/requires-recent-login' and that logic is on the place.

2) updatePhoneNumber will throw this error on mfa enrolled user:
https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyPhoneNumber?key=***
```
{
"error": {
"code": 400,
"message": "UNSUPPORTED_FIRST_FACTOR : The account has MFA enabled, please sign-in with MFA eligible first factor.",
"errors": [
{
"message": "UNSUPPORTED_FIRST_FACTOR : The account has MFA enabled, please sign-in with MFA eligible first factor.",
"domain": "global",
"reason": "invalid"
}
]
}
}
```

3) If you have no factors enrolled and use updatePhoneNumber on number XXXXX, MFA enrollment wont let you use this factor to add MFA

Everything works perfectly fine in same project with user who has zero MFA factors enrolled.
#### Steps to reproduce:
Basically create user with MFA factor enrolled and try 2 methods as documented in firebase updatePhoneNumber and verifyBeforeUpdateEmail, then you can try to update user phone who has no enrollment in mfa and try to use same number to add mfa to get number 3 issues.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.