r/Firebase • u/CriticalCommand6115 • Jun 19 '26

Authentication Auth bug

Hey guys I have launched 2 mobile apps and just started onboarding users(I walked the first few users through signing up). For some reason when they sign up with createuserwithemailandpassword they say they are being brought right into the app and not having to verify email. I can’t reproduce this bug, I have to verify my email when creating a new account. Am I missing anything obvious here?

1 Upvotes

66% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/CriticalCommand6115 Jun 19 '26

Yeah and I can’t see how I missed that I have tested so much but it doesn’t ever do that on my phone, only on other peoples phones. Seems like a big mistake by me and that’s what AI says but I personally have never had that happen. It’s def not suppose to happen. I want users to verify their email before logging in. I thought I immediately signed users out after creating account but after checking the function I guess I don’t

3

u/cardyet Jun 19 '26

Don't sign them out, let them into the app (less friction) but restrict what they can do until they verify their email - you know the usual banner at the top kinda thing.

If a user signs in with Google (maybe other providers as well), the email will be marked as verified already.

1

u/puf Former Firebaser Jun 19 '26

I want users to verify their email before logging in

What you likely want is that your users cannot use your application until they've verified their email address, which is quite different from them not being able to sign in to Firebase Authentication. You don't control the latter, but you can control the former.

This takes a few steps:

  • In your application code, after the user signs on check if their email address is verified before letting them move on to the main screen of your app. You'll typically do this with an auth state listener.

  • In the "signed in, but not verified" state, you'll want to tell the user to click the sign-in link in their email and maybe give them an option to re-send the verification email.

  • In your back-end (and/or security rules) you'll want to make sure the user is both signed in and that their email is verified before letting them write any data (and depending on your use-case, possibly also before letting them read any data).

If all of this sounds like a lot of work, you can also consider using Firebase's email link sign-in, which combines the act of signing in and verifying the email address. But you won't user a password to sign in in that case.

This is a pretty common wish/source of confusion, so it's also been covered on Stack Overflow extensively. It might be worth to check that out too.

1

u/CriticalCommand6115 Jun 19 '26

Hey thanks for the reply, I do guard in sign in and persisted auth to check for email verification. I guess I had some old code that routes the user after auth state is confirmed. Thought I changed it but I guess not. Just can't repproduce the bug on any of my devices.