Firebase 身份验证提供商悄悄地将密码更改为 google.com

Question

I use firebase authentication for my web app with three providers: email-password, google, or facebook. I have enabled the option "One account per email address".

When a user signs up using email-password (with a gmail address), then later uses google sign-in, I expect to receive an exception "auth/account-exists-with-different-credential", but I do not. His providerId is changed to google.com and he cannot use his password anymore (throws "auth/wrong-password").

Is this normal behaviour?

Answer 1

Firebase Authentication has a concept of a preferred provider for certain email addresses. The most common one is that google.com is the preferred provider for @gmail.com addresses, but I think they also exist for Facebook and Microsoft accounts.

If an existing account later signs up again from a preferred provider, that provider overwrites the existing user account. There is no way to change this behavior (that I know of).

Also see:

• Github issue Facebook provider overwritten by Google provider
• Mailing list Firebase Social Authentication Issue with fb and gmail flow
• Authentication using Facebook at first and then Google causes an error in Firebase for Android

Answer 2

This is how I'm solving it: https://firebase.google.com/docs/auth/android/account-linking

Just link the "accounts".

Answer 3

Update 2023:

You can now choose if you want to allow 'User account linking'. For example, if you don't allow multiple accounts with the same email address, a user cannot create a new account that signs in using a Google Account with the email address ex@gmail.com if there already is an account that signs in using the email address ex@gmail.com and a password.

If you do allow multiple accounts with the same email address, your app's sign-in flow cannot rely on an email address to identify a user account.

You can find this under settings within Firebase Authentication.

There are some caveats to using this feature, please read about it here