firebase / firebase/firebase-js-sdk

MFA TOTP resolveSignIn fails with "user._updateTokensIfNecessary is not a function" error

Open
#8,647 3 comments 0 reactions 0 assignees View on GitHub
api: auth needs-attention question stack:NextJS
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Operating System

macOS Ventura 13.6.6

### Environment (if applicable)

Node.js v20.1.0 Chrome 128

### Firebase SDK Version

v9.22.0 (still reproducible in the latest version v11.0.2)

### Firebase SDK Product(s)

Auth

### Project Tooling

Next.js app with React and Jest for testing. Built using TypeScript.

### Detailed Problem Description

When attempting to reauthenticate a user with MFA (TOTP) enabled, the following error occurs:

What I was trying to achieve:
- Reauthenticate a user using Google sign-in
- Handle MFA_REQUIRED error by resolving with TOTP code

What actually happened:
- The initial reauthentication throws MFA_REQUIRED as expected
- When calling `mfaResolver.resolveSignIn()` with TOTP assertion, it fails with an internal error

Error message:

```
user._updateTokensIfNecessary is not a function
at UserCredentialImpl._forOperation
at MultiFactorResolverImpl.eval [as signInResolver]
at ...(my functions)
```

This appears to be an internal Firebase Auth SDK issue where the user object is missing an expected method during the MFA resolution process.

### Steps and code to reproduce issue

```ts
const auth = getAuth()
try {
await reauthenticateWithPopup(auth.currentUser!, new GoogleAuthProvider())
} catch (error) {
const fbError = error as FirebaseError
if (fbError.code === AuthErrorCodes.MFA_REQUIRED) {
const mfaResolver = getMultiFactorResolver(auth, fbError)
const totpInfo = mfaResolver.hints.find(
(info) => info.factorId === FactorId.TOTP,
)
if (!totpInfo) {
throw new Error('TOTP is not enrolled')
}

// user inputs otp

const multiFactorAssertion = TotpMultiFactorGenerator.assertionForSignIn(
totpInfo.uid,
otp,
)

// fails with the error
await mfaResolver.resolveSignIn(multiFactorAssertion)
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.