How to check whether a user is exist in firebase before sending reset email?

Question

I am using Firebase authentication in my React Native application development. The problem I am facing is On implementing reset password functionality users receiving emails even though they are not a registered user in Firebase.

1. How can I send reset password emails only for Firebase registered users?

2. How can I achieve this from the frontend side(React Native)?

Here is the code I am using.

import firebase from '@react-native-firebase/app';

export function onForgotPassword(email: string) {
  firebase
    .auth()
    .sendPasswordResetEmail(email)
    .then(() => {
      // alert('Please check your email...');
    })
    .catch((e) => {
      NLog.log(e);
    });
}

Thanks in advance.

Answer 1

I'd probably agree with Anthony's comment and leave it to Firebase to sort this out.

If you really want to handle it in your code, you can use fetchSignInMethodsForEmail to check if an email address is known for any provider before trying to send a reset message to it.

Answer 2

1. You should use Firebase Admin and Cloud Functions. Get user by email if exists then send email. if not throw error.

https://firebase.google.com/docs/auth/admin/manage-users

2. This task should not be in front-end. As I understand the strategy of Google. You handle security in your backend. Think about someone can use Front-end library to query a bunch of your user emails. Strategy to handle this case you can research rate limit or delay response.