Disable Identity Toolkit when using Firebase Authentication

Question

I just set up a new project for Firebase and it is requiring me to enable Identity Toolkit API.

This is a problem because, even though I'm wrapping the firebase.auth().signInWithEmailAndPassword() in a try catch, the Identity Toolkit still posts and I can't catch the error.

It causes security risks like this when displaying post error.

errors: [{message: "EMAIL_NOT_FOUND", domain: "global", reason: "invalid"}]

Which means a malicious user could try to log in until they don't get this error message to see if an email exists.

I have looked throughhttps://developers.google.com/identity/toolkit/migrate-firebase but I am not clear on what it is trying to do.

The other problem is it costs money:

Free price/count 0 - 50K count/month

$ 0. 0055 price/count 50K - 100K count/month

How can I use Firebase without the Identity Toolkit?

Answer 1

This change should be done by the Cloud Identity Platform engineering team and you need to create a private ticket in the Issue Tracker

Answer 2

Use fireabase CLI

Please install firebase-tools
Please check this url
https://firebase.google.com/docs/cli