firebase / firebase/firebase-js-sdk
Auth checkActionCode/verifyPasswordResetCode does not throw auth/user-disabled error
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### Environment
* Operating System version: macOS 10.15.7
* Browser version: Firefox 87.0
* Firebase SDK version: 7.16.0
* Firebase Product: auth
### Problem
The available functions to validate an action code do not throw errors if the user is disabled.
According to the documentation it should: https://firebase.google.com/docs/reference/js/firebase.auth.Auth#checkactioncode
#### Steps to reproduce:
1. Disable the user in Firebase console (email/password provider)
2. Call sendPasswordResetEmail
3. Open link in email (we have a custom url but it does the same thing on the default page)
4. Call either checkActionCode/verifyPasswordResetCode
5. No auth/user-disabled error is thrown but according to the documentation it should.
I only get the error after calling confirmPasswordReset.
#### Notes
I can see an http request when I open the page; i guess its for validating the code (I only changed the key/email in the content)
Request:
```
POST https://www.googleapis.com/identitytoolkit/v3/relyingparty/resetPassword?key=SOME_API_KEY
{"oobCode":"SOME_OOB_CODE"}
```
Response:
```json
{
"kind": "identitytoolkit#ResetPasswordResponse",
"email": "user@example.com",
"requestType": "PASSWORD_RESET"
}
```
Contributor guide
Assessment
This issue has not been assessed yet.