1

In my app, when the user put an email and password he can signup up and login. but how can I make sure that the registered user is the email owner and not using someone's email (I'm using firebase for authentication).

  • Asking user to verify their email when they signup ?
  • Prevent them from logging in unless they activate their email ?

if any of those above, how to do it ?

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
John vattic
  • 51
  • 1
  • 7

1 Answers1

8

It is possible that you will need to update your version of the Firebase SDK. Firebase User in the auth module has the ability to send an email verification using the function user.SendEmailVerification:

For Example

FirebaseAuth auth = FirebaseAuth.getInstance();
FirebaseUser user = auth.getCurrentUser();

user.sendEmailVerification()
        .addOnCompleteListener(new OnCompleteListener<Void>() {
            @Override
            public void onComplete(@NonNull Task<Void> task) {
                if (task.isSuccessful()) {
                    Log.d(TAG, "Email sent.");
                }
            }
        });

In the case that you want to limit access to the application you'll need to use user.isEmailVerified(). How exactly you use this will depend on what behavior you want your app to exhibit. Note that that the FirebaseUser object is cached so you may need to call .getCurrentUser().reload(). You could either do this on a timer or when the user returns to the app. Alternatively you could check this after a login and if they are not verified log them out, and display a message saying they are not verified and wait for them to try again.

For a more complete discussion see: https://firebase.googleblog.com/2017/02/email-verification-in-firebase-auth.html

meursault334
  • 116
  • 5
  • You're right. This function (sendEmailVerification) is available, but the question is how and where to use ? when the user signs up or when he log in or what ? – John vattic Apr 23 '18 at 21:53
  • I edited the answer to include a discussion of how to use user.isEmailVerified(). How you use this is up to you but probably the cleanest way to do it is to send the verification email and then log them out upon registration and then log them out immediately after a login if their account is not yet verified and display a message (possibly offer to resend a verification email). – meursault334 Apr 24 '18 at 18:45