Is there any way to do email confirmation for Firebase user creation and/or password reset?

Question

Question says it all. In Firebase, how do I confirm email when a user creates an account, or, for that matter, do password reset via email.

I could ask more broadly:

Answer 1

[Engineer at Firebase - Update 2014-01-27]

Firebase Simple Login now supports password resets for email / password authentication.

Each of the Simple Login client libraries has been given a new method for generating password reset emails for the specified email address - sendPasswordResetEmail() on the Web and Android, and sendPasswordResetForEmail() on iOS.

This e-mail will contain a temporary token that the user may use to log into their account and update their credentials. This token will expire after 24 hours or when the user changes their password, whichever occurs first.

Also note that Firebase Simple Login enables full configuration of the email template as well as the sending address (including whitelabel email from your domain for paid accounts).

To get access to this feature, you'll need to update your client library to a version of v1.2.0 or greater. To grab the latest version, check out https://www.firebase.com/docs/downloads.html.

Also, check out https://www.firebase.com/docs/security/simple-login-email-password.html for the latest Firebase Simple Login - Web Client docs.

Answer 2

This would need to be done outside of firebase. I store users at /users/ and keep a status on them (PENDING, ACTIVE, DELETED). I have a small service that monitors users of a PENDING status and sends out a confirmation email. Which has a link to a webservice I've created to update the user status to ACTIVE.

Answer 3

As at 2016 July, you might not have to use the reset link etc. Just use the sendEmailVerification() and applyActionCode functions:

In short, below is basically how you'll approach this, in AngularJS:

// thecontroller.js
$scope.sendVerifyEmail = function() {
    console.log('Email sent, whaaaaam!');
    currentAuth.sendEmailVerification();
  }

// where currentAuth came from something like this:
// routerconfig

....
templateUrl: 'bla.html',
resolve: {
    currentAuth:['Auth', function(Auth) {
      return Auth.$requireSignIn() // this throws an AUTH_REQUIRED broadcast
    }]
  }
...

// intercept the broadcast like so if you want:

....

$rootScope.$on("$stateChangeError", function(event, toState, toParams, fromState, fromParams, error) {
      if (error === "AUTH_REQUIRED") {
        $state.go('login', { toWhere: toState });
       }
    });
....

// So user receives the email. How do you process the `oobCode` that returns?
// You may do something like this:

// catch the url with its mode and oobCode
.state('emailVerify', {
  url: '/verify-email?mode&oobCode',
  templateUrl: 'auth/verify-email.html',
  controller: 'emailVerifyController',
  resolve: {
    currentAuth:['Auth', function(Auth) {
      return Auth.$requireSignIn()
    }]
  }
})

// Then digest like so where each term is what they sound like:

.controller('emailVerifyController', ['$scope', '$stateParams', 'currentAuth', 'DatabaseRef',
  function($scope, $stateParams, currentAuth, DatabaseRef) {
    console.log(currentAuth);
    $scope.doVerify = function() {
      firebase.auth()
        .applyActionCode($stateParams.oobCode)
        .then(function(data) {
          // change emailVerified for logged in User
          console.log('Verification happened');
        })
        .catch(function(error) {
          $scope.error = error.message;
          console.log(error.message, error.reason)
        })
    };
  }
])

And ooh, with the above approach, I do not think there's any need keeping the verification of your user's email in your user data area. The applyActionCode changes the emailVerified to true from false.

Email verification is important when users sign in with the local account. However, for many social authentications, the incoming emailVerified will be true already.

Explained more in the article Email Verification with Firebase 3.0 SDK

Answer 4

The new Firebase SDK v3 appears to support email address verification, see here (put your own project id in the link) but it doesn't appear to be documented yet.

I have asked the question on SO here

See @SamQuayle's answer there with this link to the official docs.

Answer 5

I used following code to check the email verification after creating new account.

let firAuth = FIRAuth.auth()
firAuth?.addAuthStateDidChangeListener { auth, user in
    if let loggedUser = user {

        if loggedUser.emailVerified == false {

            loggedUser.sendEmailVerificationWithCompletion({ (error) in

                print("error:\(error)")
            })
        }
        else {

            print(loggedUser.email)
        }
    } else {
        // No user is signed in.
        print("No user is signed in.")
    }
}

Answer 6

As noted by various others Firebase does now support account related emails but even better, as of 10 days ago or so it also supports sending any kind of email via Firebase Functions. Lots of details in the docs and example code here.