firebase / firebase/firebase-tools

Firebase auth emulator does not respect Email Enumeration Protection when enabled.

Open
#6,687 2 comments 0 reactions 0 assignees View on GitHub
emulators: auth type: feature request
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### [REQUIRED] Environment info

**firebase-tools:** 13.0.3

**Platform:** Windows

### [REQUIRED] Test case

When enabling [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#overview) through the firebase console it does not reflect on the authentication emulator when running the emulator with the project id of my firebase project and executing functions like `sendPasswordResetEmail`.

### [REQUIRED] Steps to reproduce

init the emulators:

```bash
firebase login
firebase use $YOUR_PROJECT_ID
firebase emulators:start --only auth
```

boiler plate html:
```html




Document


reset

import { initializeApp } from "https://www.gstatic.com/firebasejs/10.7.1/firebase-app.js";

const app = initializeApp({
// ...
});

import {
getAuth,
connectAuthEmulator,
sendPasswordResetEmail,
} from "https://www.gstatic.com/firebasejs/10.7.1/firebase-auth.js";

const auth = getAuth(app);
connectAuthEmulator(auth, "http://127.0.0.1:9099");

const btn = document.getElementById("reset-btn");
btn.addEventListener("click", () => {
sendPasswordResetEmail(auth, "fake@fake.fake");
});

```

Click the button to execute the `sendPasswordResetEmail` function with a fake email address not registered in the list of users.

### [REQUIRED] Expected behavior

Return a `200` status code and the following JSON object:

```json
{
"kind": "identitytoolkit#GetOobConfirmationCodeResponse",
"email": "fake@fake.fake"
}

```

### [REQUIRED] Actual behavior

It returns a `400` status code and the following JSON object:

```json
{
"error": {
"code": 400,
"message": "EMAIL_NOT_FOUND",
"errors": [
{
"message": "EMAIL_NOT_FOUND",
"reason": "invalid",
"domain": "global"
}
]
}
}

```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with firebase emulators:start --only auth and the provided sendPasswordResetEmail example, using a project with Email Enumeration Protection enabled. Trace how the Auth emulator handles the password-reset request and compare it with the documented expected response; done means the emulator returns HTTP 200 with the expected JSON instead of EMAIL_NOT_FOUND.

Written by the indexing model from the issue text.

Assessment

Tech stack
firebase, typescript
Domain
authentication, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.