Firebase Admin SDK - Check user's password against variable on server

Question

I am trying to implement a feature for a user to change their password in their settings page when they are logged in, and I require the user's old password as well as the new password when they try to change it as an extra security measure. My problem is that I cannot find a way to verify if the user's old password is correct. Is there an easy way to do this?

I receive the entered form inputs on the server so the solution would have to be on the backend (node.js)

Many thanks

Answer 1

You have to do it client side. This is not an operation that the admin SDK is designed to handle. You will ask the current user for the password and reauthenticate with it and then update password:

const cred = firebase.auth.EmailAuthProvider.credential(
    firebase.auth().currentUser.email, oldPass);
firebase.auth().currentUser.reauthenticateWithCredential(cred)
  .then(() => {
    return firebase.auth().currentUser.updatePassword(newPass);
  })
  .catch((error) => {
    // Some error.
  });