How to check if current password is valid in firease admin sdk?

Question

I have a firebase powered app. The requirement is to update the account password by typing the currentPassword and the newPassword.

On the server (firebase cloud function + admin sdk) i need to check if the provided currentPassword is valid.

When an account is created for the first time, firebase automatically encrypts the password, and gives me back only the hash.

The problem is - this encryption is done automatically, under the covers.

Without having access to the encryption method, i can't obtain the hash of the currentPassword in order to compare it to the stored hash of the real password.. to see if this 2 hashes match.

So how can i check if the currentPassword is valid? How to get access to the same method firebase-auth uses for encryption?

I coudn't find anything relevant so far. am I using the wrong approach here? Why is it so hard to find it ?

Answer 1

I'm not quite sure that you can verify the password with cloud function, the point is to make sure that hackers would not be able to recover users' passwords even if they somehow hacked into the server, if you can recover the passwords by knowing the hash and salt, why wouldn't them hackers? However, you can do that in your app:

firebase.auth().currentUser.reauthenticateWithCredential(firebase.auth.EmailAuthProvider.credential(firebase.auth().currentUser.email, oldPassword);

Also, just to provide an alternative way for users who want to change their password, just send them a reset password email, this way, it's quite safe and they won't have to enter their old password:

firebase.auth().sendPasswordResetEmail(firebase.auth().currentUser.email)

Answer 2

passwordHash and passwordSalt are only available when you retrieve the user information via a call to listUsers(). Therefore they are only useful if you ever migrate user data from Firebase Auth to a different user management system.