Firebase Authentication Security: Making email+password errors generic

Question

I've made a page that allows sign in using Firebase. But our tester is raising a security concern about adding too much information in these messages - we want to have a generic error instead ("Invalid email or password") rather than saying "Invalid email" and "Invalid password" to prevent malicious parties knowing which emails are registered. Is there any ways to change the errors generated from the Firebase system?

Sorry, i was hoping someone else would have a way, but I'll.accept your answer. — Karim Abdel Hamid
– Karim Abdel Hamid, Commented Mar 18, 2021 at 23:10

Frank van Puffelen · Accepted Answer · 2021-03-17 22:47:58Z

1

You can't change the error messages generated by Firebase. The only way to control messages that the user sees while still using Firebase Authentication would be create your own custom provider and then raise messages from there.

You might want to file a feature request for this, although there's no guarantee it will be implemented in a timeframe that suits your project.

edited Mar 17, 2021 at 22:47

answered Mar 14, 2021 at 17:02

Frank van Puffelen

603k85 gold badges895 silver badges869 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Firebase Authentication Security: Making email+password errors generic

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related