Prevent user to signup with same user credentials after account id deleted in Firebase Authentication

Question

I want to know is it possible to disable the user signing up in the application after he makes a request to delete his/her account from the app.

I don't want to let the user to use same login credentials to signup again that are deleted earlier.

I observed when we delete the account of a user from the firebase console or a user deletes the account with his own consent he/she can use the same credentials to signup again into the application. If this happens then the user can create a bunch of junk data for me by deleting and creating multiple user-id.

I know about the disabled account but this can account disabling can't be done from client-side SDK and only delete is available so, how can I ban the user to use the same credentials to sign-up again.

Frank van Puffelen · Answer 1 · 2020-09-29T19:01:52.267

0

When you delete the user account from Firebase Authentication, all information about that account is gone. To instead prevent a user from signing in with an account, you'll want to instead disable their account in the Firebase console (or through the Admin SDK).

If you want prevent new users from creating other resources, you'll want to create some approval process in your sign-up flow. Firebase Authentication does not handle this for you.

If you want to prevent the same person to create resources under a newly created account, you'll want to use some other basis to identify that user (their email address being the most common) in your backend (code or security rules) and grant/deny resource creation permission based on that.

edited Sep 29 '20 at 19:01

answered Sep 29 '20 at 19:00

Frank van Puffelen

565,676
79
828
807

The question indicates that they're aware of the fact that accounts can be disabled, and they're looking for a client side solution. – Doug Stevenson Sep 29 '20 at 19:01
https://stackoverflow.com/a/54960134/12806124 in the above answer you've given I wants to know how can I do the second step mentioned. – CodeRED Innovations Sep 29 '20 at 20:26

score 0 · Answer 2 · answered Sep 30 '20 at 15:41

0

You could store a users credentials (e.g. a hash of email and / or password) in a cloud firestore table when the user gets deleted and validate a new user against this table to see if it was deleted before.

answered Sep 30 '20 at 15:41

lukger

404
3
11

Is this the only way to do..!! I guess this is not the best solution to keep a record of data who deletes account. Is there a method from the authentication side to be done without keeping a record additional in firestore or realtime database – CodeRED Innovations Sep 30 '20 at 16:42
Well i do not think it's the only way to do it but this could certainly be one way of doing it. Maybe it would be easier to handle the whole "new account creation" in a backend of some sort. like a node js backend that could also be hosted via firebase. – lukger Oct 01 '20 at 18:18

Prevent user to signup with same user credentials after account id deleted in Firebase Authentication

2 Answers2