Laurence Moroney
Developer AdvocateTo solve this problem, Email Verification has been added to Firebase Auth -- where, in the above case, Firebase will send an email to that address containing a validation link. So if that celebrity really is signing up for your app, he'll get the link and click on it. You can check to see if the account is verified at sign in, and take an action in response -- such as blocking them from signing in.
- Exploring Email Verification
When you run the app, and select the Email/Password authentication activity, you'll see this screen, where it gives you the option to sign in (if you have an account already), or create one (if you don't).
When you click the 'Create Account' button, you'll get taken to a new activity, showing the user identity, and the Firebase User ID associated with it. You'll also see that the email isn't verified, with a button allowing you to verify it:
This email is shown on the Email Templates tab in the Authentication section of the Firebase console. From here you can edit the action link, or the reply address so that it appears to be from your domain, instead of authui-xxxx.firebaseapp.com as shown above.
Coding for Email Verification
Details on coding for email verification can be found in the Manage Users section of the Firebase documentation (Android, iOS, Web). For the rest of this post, I'll be looking at the Android code, but the implementation on the other platforms is very similar.
The core functionality is found on the FirebaseUserobject. On it is a sendEmailVerification() method, which returns as Taskused to asynchronously send the email, and report on the status. If the task is successful, you know the email was sent. Here's an example:
In this case, the user is retrieved from
After the user clicks the link in the email, subsequent calls to
Do note that the FirebaseUser object is cached within an app session, so if you want to check on the verification state of a user, it's a good idea to call
In the sample app it just shows on the activity if the user's email address is verified or not. For your app you could limit functionality based on this state -- even to the extent of denying them access to the signed in section of the app.
You can learn more about Firebase Auth, including sign-in with other providers such as Google, Facebook, Twitter and more on the Firebase developers site.
final FirebaseUser user = mAuth.getCurrentUser();
user.sendEmailVerification()
.addOnCompleteListener(this, new OnCompleteListener() {
@Override
public void onComplete(@NonNull Tasktask) {
// Re-enable button
findViewById(R.id.verify_email_button).setEnabled(true);
if (task.isSuccessful()) {
Toast.makeText(EmailPasswordActivity.this,
"Verification email sent to " + user.getEmail(),
Toast.LENGTH_SHORT).show();
} else {
Log.e(TAG, "sendEmailVerification", task.getException());
Toast.makeText(EmailPasswordActivity.this,
"Failed to send verification email.",
Toast.LENGTH_SHORT).show();
}
}
});
In this case, the user is retrieved from
mAuth.getCurrentUser(), and the sendEmailVerification() method is called on it. This gets Firebase to send the mail -- and if the task was successful, you'll see that a toast will pop up showing that it happened. After the user clicks the link in the email, subsequent calls to
user.isEmailVerified()will return true. Here's how it is used in the sample app: mStatusTextView.setText(getString(R.string.emailpassword_status_fmt,
user.getEmail(), user.isEmailVerified()));
Do note that the FirebaseUser object is cached within an app session, so if you want to check on the verification state of a user, it's a good idea to call
.getCurrentUser().reload() for an update.In the sample app it just shows on the activity if the user's email address is verified or not. For your app you could limit functionality based on this state -- even to the extent of denying them access to the signed in section of the app.
You can learn more about Firebase Auth, including sign-in with other providers such as Google, Facebook, Twitter and more on the Firebase developers site.
