4

I am using the Simple Login Email / Password Authentication functionality of Firebase.

I would like to manage users through Forge only. I don't want users to be created via the client app.

However I would still like to let them login/logout though.

Is this possible?

Greg
  • 31,180
  • 18
  • 65
  • 85
  • 1
    See [http://stackoverflow.com/questions/21815229/is-there-a-way-to-restrict-registrations-in-firebase/21834842#21834842](http://stackoverflow.com/questions/21815229/is-there-a-way-to-restrict-registrations-in-firebase/21834842#21834842) which shares your question. – Rob DiMarco Jun 05 '14 at 15:58
  • You are correct, this is a duplicated question. I've voted to close this question as a result. Thanks for your insights though guys, very helpful as always! – Greg Jun 05 '14 at 20:04

1 Answers1

6

You can't prevent users from being created on the client using simple login. There are two options you can utilize instead:

Simple Login "accounts" are really just tokens

Simple Login is just a convenience wrapper that creates Firebase tokens. There is no limit on how many accounts can be stored and they have no affect on your Firebase usage. With this in mind, there's really no reason you need to restrict creation of accounts.

Instead, just utilize security rules to control access to data. When an admin creates an account, have them also add a profile into the data. If only an admin in Forge is allowed to create the profile, then someone could create an account, but it would be superfluous and pointless, since all it does is give them an inert token.

A security rule to enforce access to data:

".write": "root.child('valid_account/'+auth.uid).exists()"

A security rule that allows users to edit their profile but only Forge (admin: true) to create them:

"profiles": {
  "$uid": {
    ".write": "data.exists() && auth.uid === $uid && newData.exists()"
  }
}

Creating your own tokens allows complete control

If you're terribly OCD and don't like that approach, then you can cut out Simple Login. As stated previously, it just creates tokens on your behalf. So simply create your own.

In this way you have complete control over account creation and token generation.

Kato
  • 40,352
  • 6
  • 119
  • 149
  • Your rule should read: `".write": "auth != null && root.child('valid_account/'+auth.uid).exists()"` otherwise, you're getting denied because it can't add the path to null (auth.uid is null if not authenticated) - but it seems like you want to do something more than deny access on an operator error. The exact error you get without checking for `auth != null` is: `Type Error: + only operates on numbers and strings.` ;) – jpoveda Nov 30 '15 at 02:24
  • Great point. While it helps with reading the errors in the simulator, it doesn't actually affect what users see or change the rule behavior. It's a short circuit, since user must still be authenticated for the rule to pass. – Kato Dec 03 '15 at 01:40