shockbytes / DanteX

Dante - Book Tracker Cross Platform Implementation
Apache License 2.0
29 stars 1 forks source link

Enable email enumeration protection #97

Open lockieRichter opened 7 months ago

lockieRichter commented 7 months ago

Firebase recently made email enumeration protection on by default for all new projects. They also reccomend updating existing projects to use the setting as well.

See here for details of this setting and how it affects workflow.

We should consider enabling this for DanteX, but this will require some careful thought and rework of our login flow as we currently use the fetchSignInForEmail method. Part of enabling this setting will also prevent us from linking anonymous users with an email account unless we have the right SDK version.

Linking anonymous authenticated users with an email address will also not work prior to SDK version 22.3.0 for Android, 10.18.0 for iOS, and 10.6.0 for Web.