Search code examples
firebasefirebase-authentication

Disabling auth/user-not-found functionality

I have a React application with email & password sign in method available (implemented with firebase). In the log in form, if you enter incorrect email, you will get auth/user-not-found error as expected.

What are my options to disable this kind of behaviour? To me it seems to be a security risk where malicious user could query email addresses and see if the user exists on my platform or not.

Solution

  • You cannot disable what firebase would respond with, but you should handle the error in your client to show a less specific response.

    try {
...
} catch (err) {
  if (err.code === 'auth/user-not-found') {
     alert("Invalid email address and/or password")
  } else {
    console.log("Other error handling method")
  }
}