Forget password for Firebase Authentication with invalid email address

Question

Firebase's email/password signup doesn't check if an email is valid - user can create an account with an email like user1@gmail.com even if that email doesn't exist on google.

The issue is that if, a user forgets their password and we send a password reset email to that invalid email, the user wont be able to reset their password.

How to get around this issue?

Answer 1

If you stick to using email+password authentication, there isn't really a good way to handle the scenario. Technically, you can change the password through the Admin SDK . But the problem is that you have no way to verify that the user is really the owner of the account, so you might be handing the new password to a malicious user.

If you want the user to only be able to sign in after their email address has been verified, consider using email link authentication .