Firebase Admin SDK - Check user's password against variable on server

Question

I am trying to implement a feature for a user to change their password in their settings page when they are logged in, and I require the user's old password as well as the new password when they try to change it as an extra security measure. My problem is that I cannot find a way to verify if the user's old password is correct. Is there an easy way to do this?

I receive the entered form inputs on the server so the solution would have to be on the backend (node.js)

Many thanks

Answer 1

Though the accepted solution works, there is also a way to verify a user's password from the backend, using the Google Identity Kit REST API's "verifyPassword" endpoint (which has recently been renamed to "signInWithPassword", but works exactly the same):

HTTP POST https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=[YOUR_FIREBASE_API_KEY]
{
  email,
  password,
}

If that endpoint doesn't return an error, that means the password is valid.

See this thread for more information.