firebase reauthenticateWithCredential和signInWithCustomToken

Question

i use the signInWithCustomToken method to establish a login in my single page app through a redirect from another app.

in my SPA i would like to let the user set it's password via currentUser.updatePassword(newPassword) . this works fine unless the user needs to re-authenticate:

important: this is a security sensitive operation that requires the user to have recently signed in. If this requirement isn't met, ask the user to authenticate again and then call firebase.User#reauthenticateWithCredential.

i have not found a method to use the custom-token to reauthenticate. did i miss something?

Answer 1

Yeah, there is no reauthenticateWithCustomToken. You would need to go through the custom token sign in process again (if you are using some unsupported provider, sign in with that provider and mint a new custom token), confirm the UID matches the previous user as you don't want to switch the user. You then call updatePassword on the new user.

You can instantiate a new Firebase app in the process where you sign in the user with the new custom token, if the UIDs match, then just signInWithCustomToken with the same custom token (reusable until it is expired) in the original auth instance and then call updatePassword on the updated currentUser.