firebase / firebase/firebase-tools
Firebase auth emulator does not respect Email Enumeration Protection when enabled.
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.3k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 84
Description
### [REQUIRED] Environment info
**firebase-tools:** 13.0.3
**Platform:** Windows
### [REQUIRED] Test case
When enabling [Email Enumeration Protection](https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection#overview) through the firebase console it does not reflect on the authentication emulator when running the emulator with the project id of my firebase project and executing functions like `sendPasswordResetEmail`.
### [REQUIRED] Steps to reproduce
init the emulators:
```bash
firebase login
firebase use $YOUR_PROJECT_ID
firebase emulators:start --only auth
```
boiler plate html:
```html
Document
reset
import { initializeApp } from "https://www.gstatic.com/firebasejs/10.7.1/firebase-app.js";
const app = initializeApp({
// ...
});
import {
getAuth,
connectAuthEmulator,
sendPasswordResetEmail,
} from "https://www.gstatic.com/firebasejs/10.7.1/firebase-auth.js";
const auth = getAuth(app);
connectAuthEmulator(auth, "http://127.0.0.1:9099");
const btn = document.getElementById("reset-btn");
btn.addEventListener("click", () => {
sendPasswordResetEmail(auth, "fake@fake.fake");
});
```
Click the button to execute the `sendPasswordResetEmail` function with a fake email address not registered in the list of users.
### [REQUIRED] Expected behavior
Return a `200` status code and the following JSON object:
```json
{
"kind": "identitytoolkit#GetOobConfirmationCodeResponse",
"email": "fake@fake.fake"
}
```
### [REQUIRED] Actual behavior
It returns a `400` status code and the following JSON object:
```json
{
"error": {
"code": 400,
"message": "EMAIL_NOT_FOUND",
"errors": [
{
"message": "EMAIL_NOT_FOUND",
"reason": "invalid",
"domain": "global"
}
]
}
}
```
Contributor guide
Research direction
Reproduce the issue with firebase emulators:start --only auth and the provided sendPasswordResetEmail example, using a project with Email Enumeration Protection enabled. Trace how the Auth emulator handles the password-reset request and compare it with the documented expected response; done means the emulator returns HTTP 200 with the expected JSON instead of EMAIL_NOT_FOUND.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- firebase, typescript
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100