auth.token.email realtime database whith firebase Authentication

Question

is possible in realtime database rules validate if email exist in Authentication?

because I login at https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=[API_KEY] and get idToken to log in to the realtime database, but I would like to know if there is a way to validate if auth.token.email = authentication email and email enabled this is a result of an idToken base64 decode:

I need to know if "email": "[email protected]" exists in Authentication user

{
 "iss": "https://securetoken.google.com/xaxaxaxa",
 "aud": "xaxaxaxa",
 "auth_time": 1567541399,
 "user_id": "xxxxaxxaxaxaxaxaxax",
 "sub": "xaxaxaxaxaxaxaxa",
 "iat": 1567541399,
 "exp": 1567544999,
 "email": "[email protected]",
 "email_verified": false,
 "firebase": {
  "identities": {
   "email": ["[email protected]"]
  },
  "sign_in_provider": "password"
 }
}

Frank van Puffelen · Accepted Answer · 2019-09-04 14:32:04Z

0

Security rules can't check whether a certain email address exists. All they can do is read the claims in the token and act on that. But usually there's a "email_verified" claim in the token that you can use to ensure that the email address was verified:

"someNode": {
  ".write": "auth.token.email_verified === true"
}

Verification can happen either by the provider (such in the case of the Google and Facebook providers), or by your own code through the Admin SDK.

answered Sep 4, 2019 at 14:32

Frank van Puffelen

603k85 gold badges895 silver badges868 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

auth.token.email realtime database whith firebase Authentication

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related