0

So I am trying to implement a change password feature. I am able to to do it using updatePassword (newPassword) method. I would like to do some verification before this.So for example when the user wants to change his password, he presses a button and then:

  1. User enters current password
  2. User enters new password

  3. User enters new password again.

How do I verify that the current password the user inputted is correct? There does not seem to be a method that gets me the current password of the user to compare it with.

4
  • That would be a breach of security if you could get their current password Feb 11, 2018 at 3:55
  • I did not consider that. That does make sense. Feb 11, 2018 at 4:02
  • So there is no way I can get the password from a user right? Unless I pass it through in an Intent in the Login Activity? Feb 11, 2018 at 4:03
  • You're looking for re-authenticate which I answered below. You should absolutely avoid doing anything with passwords other than handing them directly to firebase, otherwise you are responsible for their security. Intents, depending on implementation, could threaten security if they contain a plaintext password. Feb 11, 2018 at 4:32

1 Answer 1

2

What you are looking for is "Re-authenticate a user" which is discussed in Firebase's authentication documention. The idea is that you must have the user re-enter their old information into the user.reauthenticate method and firebase will verify the information and you continue operations in onComplete if successful, or firebase sends you an exception. You would use updatePassword in onComplete like below. Your UI would look like its one transaction but really its reAuthenticate -> updatePassword. You additionally may be able to assume the user username/email based on how you store user information.

FirebaseUser user = FirebaseAuth.getInstance().getCurrentUser();
String newPassword = "SOME-SECURE-PASSWORD";

// Get auth credentials from the user for re-authentication. The 
//example below shows
// email and password credentials but there are multiple possible 
//providers,
// such as GoogleAuthProvider or FacebookAuthProvider.
AuthCredential credential = EmailAuthProvider
    .getCredential("[email protected]", "password1234");
// The email and password should be extracted from an EditText

// Prompt the user to re-provide their sign-in credentials
user.reauthenticate(credential)
    .addOnCompleteListener(new OnCompleteListener<Void>() {
        @Override
        public void onComplete(@NonNull Task<Void> task) {
            Log.d(TAG, "User re-authenticated.");
            user.updatePassword(newPassword)
               .addOnCompleteListener(new OnCompleteListener<Void>() {
                  @Override
                  public void onComplete(@NonNull Task<Void> task) {
                     if (task.isSuccessful()) {
                        Log.d(TAG, "User password updated.");
                     }
                  }
               });
        }
    });
3
  • Yea, I am quite reluctant to use Intents since it feels hacky. Yours is an excellent solution! Thanks!! Feb 11, 2018 at 4:42
  • Bear in mind, if you had not used re-authenticate, firebase may have thrown an exception anyways to re-authenticate. This is standard for most of the editing methods in firebase's manage users section. Feb 11, 2018 at 4:48
  • I see. That is good to know because currently I am using updatePassword() method by itself and it sometimes fails. I'll try your way. Thanks once again. Feb 11, 2018 at 4:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.