search

firebase / firebaseui-web

FirebaseUI is an open-source JavaScript library for Web that provides simple, customizable UI bindings on top of Firebase SDKs to eliminate boilerplate code and promote best practices.
https://firebase.google.com/
Apache License 2.0
4.58k stars 1.06k forks source link

App Check isn't compatible with firebaseUI email login #1059

Open EmilioNicolas opened 10 months ago

EmilioNicolas commented 10 months ago

Describe your environment

Describe the problem

I configured App Check in my Firebase project, but if I enable it for Authentication, Firebase UI widget is not working for login/register using email. It works for users signing with Google though.

jhuleatt commented 10 months ago

Thanks for reporting this, @EmilioNicolas. My hunch is that this probably has to do with the tempApp that FirebaseUI spins up internally:

https://github.com/firebase/firebaseui-web/blob/5ff6fde2324d95d976e35ef1986ac5f241d3774e/javascript/widgets/authui.js#L127-L130

Though, to confirm, when you say Gmail users, do you mean users signing in with email and password with an @gmail.com email, or users that use Sign in with Google?

EmilioNicolas commented 10 months ago

Thanks for your reply! I mean users signing with Google Sign In

It's a known issue and the widget does not work with Firebase App Check?

If so, Any workarounds or recommended paths to avoid registration abuse?

jhuleatt commented 9 months ago

Thanks for confirming that it works for Google Sign In! That is definitely strange, since if App Check works for one auth provider type I'd think it should work for all. It's not a known issue, so we'll see if we can reproduce the issue in another project.

EmilioNicolas commented 9 months ago

It doesn't work I'm afraid. I have integrated Cloudflare Turnstile for avoiding abuse because I couldn't use Firebase app check :-(

yeldarby commented 6 months ago

We're also encountering this issue. Anyone found a workaround?

yeldarby commented 5 months ago

@EmilioNicolas how did you get Turnstile working? We haven't been able to figure out a way to match up the user from our front-end request to the beforecreated auth trigger on the backend. We tried doing it via IP address which works for 95%+ of users but it seems many users are on network connections (like universities & companies) that round robin their IP external addresses so it's not a reliable match. And it doesn't seem there's a way to pass an identifier through the auth flow to link them to the frontend session.