FR: auth - control anonymous users using recaptcha (or something else)

AoDev commented 4 years ago

[REQUIRED] Describe your environment

Operating System version: any
Browser version: any
Firebase SDK version: client: 7.6.1 (admin 8.8.0)
Firebase Product: auth

Context

The anonymous login is a very important feature for our product and works great :)

However, I could find a recaptcha integration only for phone authentication. (Sorry if I missed something, the docs are extensive).

Question

Here are some questions:

We currently could have our DB spammed with unlimited anonymous users, or there is some safeguards in place?
We wanted a captcha for anonymous users, it is something we can not do at the moment?
Is there a current alternative to avoid bots / scripts to create unlimited guest users?

Desired feature

An easy way to control anonymous users registration in Firebase with recaptcha or something else.

Thank you.

Feiyang1 commented 4 years ago

I believe we rate limit the anonymous user creation. @bojeil-google

bojeil-google commented 4 years ago

We do rate limit anonymous login. But I think the request is to block creation if it is not created by a real user and real browser (which we don't support). Currently, developers are expected to clean up inactive anonymous users using the Admin SDK APIs.

This is an interesting feature request. I would recommend you file an official request for it.

firebase / firebase-js-sdk