firebase / firebase/firebase-tools

Two user records can be created with the same phone number but different phone number formatting

Open
#5,853 1 comment 0 reactions 0 assignees View on GitHub
emulators: auth reproducible type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### Environment info

**firebase-tools:** 11.29.1

**Platform:** macOS

### Test case

I'm using flutter with the https://pub.dev/packages/firebase_auth package to reproduce the problem:
```

import 'package:firebase_auth/firebase_auth.dart';
import 'package:firebase_core/firebase_core.dart';
import 'package:flutter/material.dart';
import 'package:flutter/widgets.dart';

import 'firebase_options_dev.dart';

void main() async {
WidgetsFlutterBinding.ensureInitialized();
await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
FirebaseAuth.instance.useAuthEmulator('xxxx', 9099);

runApp(MaterialApp(home: Reproduce()));
}

class Reproduce extends StatefulWidget {
const Reproduce({Key? key}) : super(key: key);

@override
State createState() => _ReproduceState();
}

class _ReproduceState extends State {

final _codeTec = TextEditingController();
String? _verificationId;

@override
void dispose() {
_codeTec.dispose();
super.dispose();
}

@override
Widget build(BuildContext context) {
return Scaffold(
body: Center(
child: Column(
mainAxisSize: MainAxisSize.min,
children: [
FilledButton(
onPressed: () {
FirebaseAuth.instance.verifyPhoneNumber(
phoneNumber: '+1(222) 222-2222',
verificationCompleted: (PhoneAuthCredential credential) {},
verificationFailed: (FirebaseAuthException e) {},
codeSent: (String verificationId, int? resendToken) {
setState(() {
_verificationId = verificationId;
});
},
codeAutoRetrievalTimeout: (String verificationId) {},
);
},
child: Text('Send code to +1(222) 222-2222'),
),
FilledButton(
onPressed: () {
FirebaseAuth.instance.verifyPhoneNumber(
phoneNumber: '+12222222222',
verificationCompleted: (PhoneAuthCredential credential) {},
verificationFailed: (FirebaseAuthException e) {},
codeSent: (String verificationId, int? resendToken) {
setState(() {
_verificationId = verificationId;
});
},
codeAutoRetrievalTimeout: (String verificationId) {},
);
},
child: Text('Send code to +12222222222'),
),
SizedBox(height: 20.0),
TextField(
controller: _codeTec,
),
FilledButton(
onPressed: _verificationId != null ? () async {
PhoneAuthCredential credential = PhoneAuthProvider.credential(verificationId: _verificationId!, smsCode: _codeTec.text);
await FirebaseAuth.instance.signInWithCredential(credential);
} : null,
child: Text('Verify code'),
),
],
),
),
);
}
}
```

### Steps to reproduce

1. Connect a Firebase client SDK to the Firebase Auth Emulator
2. `verifyPhoneNumber` and `signInWithPhoneNumber` by using `+1(222) 222-2222`
3. `verifyPhoneNumber` and `signInWithPhoneNumber` by using `+12222222222`

### Expected behavior

Sign in as the existing user, despite phone number formatting
image

### Actual behavior

A new user record with the differently formatted phone number is created
image

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the Flutter example, using FirebaseAuth.instance.verifyPhoneNumber with both phone-number formats against the Firebase Auth Emulator. Trace the emulator behavior from verifyPhoneNumber and signInWithCredential, and consider the issue done when both formats resolve to the same user, with regression coverage for the two inputs.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.