Weird firebase email verification

Question

I am creating a messenger app. In order to register a new user, I want to get the email and password from the user, and before creating the account, I want to verify the email provided by the user.

But the problem with Firebase email verification is that you have to create an account or user first before you can send the email verification link to the user. 

Now this can lead to a significant problem: Suppose some fake user used my email and created an account but failed to verify the email. But still, he managed to create an account with my email. So if later I try to register myself to the app, then Firebase is going to show me Email already used.

To solve this issue, I want to delete an account created if the user fails to verify his email just after he tries to register himself. To do this, I created an email verification screen that is pushed as soon as a new user registers through his email and password. Now the app will be waiting for the user to verify their email by clicking the link sent by Firebase. I have also provided a cancel verification button. So if the user cancels the verification, I am just deleting the account that was already created. I am also handling if the user presses the back key without verifying their email, which will also delete the user's account.

Main Problem: Now the last thing I need to handle is if the user forces quit the app. In order to handle this I tried to delete the account in dispose method as well as I used WidgetsBindingObserver. But both of them don't work for me.

Any suggestions would be much appreciated.

Answer 1

The idea of email Link verification was created to solve this problem. Instead of creating an account and then verifying the email after, the account is just directly created from your email. So obviously you must have access to the email to create the account. See https://firebase.flutter.dev/docs/auth/usage/#email-link-authentication for details on how to implement this style of link authentication.

A similar discussion of how to handle quitting the app is occurring here How to execute code before app exit flutter . However abrupt quits from an app whether done by the user or the system are hard to handle by nature.

Answer 2

I wouldn't recommend deleting the account when quitting/ closing etc. the app since it is something legitimate users may do before confirming their email (especially if the email is delayed in being sent for whatever reason). This will cause a lot of frustration.

You could setup a Cloud Http Task to trigger the deletion of that account after a certain time (e.g. a few hours) of the account not being registered.

If they do register in time, you can cancel the task before it runs.