firebase / firebase/firebase-js-sdk

Auth checkActionCode/verifyPasswordResetCode does not throw auth/user-disabled error

Open
#4,787 2 comments 0 reactions 0 assignees View on GitHub
api: auth internal-bug-filed needs-attention question
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Environment

* Operating System version: macOS 10.15.7
* Browser version: Firefox 87.0
* Firebase SDK version: 7.16.0
* Firebase Product: auth

### Problem
The available functions to validate an action code do not throw errors if the user is disabled.
According to the documentation it should: https://firebase.google.com/docs/reference/js/firebase.auth.Auth#checkactioncode

#### Steps to reproduce:
1. Disable the user in Firebase console (email/password provider)
2. Call sendPasswordResetEmail
3. Open link in email (we have a custom url but it does the same thing on the default page)
4. Call either checkActionCode/verifyPasswordResetCode
5. No auth/user-disabled error is thrown but according to the documentation it should.

I only get the error after calling confirmPasswordReset.

#### Notes
I can see an http request when I open the page; i guess its for validating the code (I only changed the key/email in the content)

Request:
```
POST https://www.googleapis.com/identitytoolkit/v3/relyingparty/resetPassword?key=SOME_API_KEY

{"oobCode":"SOME_OOB_CODE"}
```

Response:
```json
{
"kind": "identitytoolkit#ResetPasswordResponse",
"email": "user@example.com",
"requestType": "PASSWORD_RESET"
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.