Custom Authentication password rules

[Zhelyazko Atanasov]

I'm exploring Firebase Authentication with username and password but I have a problem.

There seems to be built-in password rule - minimum length of 6 characters and if the password is not strong enough a FirebaseAuthWeakPasswordException is thrown.

Is it possible to turn off the built-in password restrictions? My app has something like a pin-based on-device only authentication and I'd like to use the already saved user pin as a firebase password. Thus I don't want a minimum length or strength enforcement from Firebase - I'd like to remove all Password-related exceptions and/or rules that are enforced by default by Firebase.

I'm also interested whether there is a way to set a custom password validation for the Reset password site that Firebase generates automatically? I'd like to force a digit-only password. Any idea how can I do this other than coding my own "Reset password" page?

[Jacob Wenger]

Hey Zhelyazko,

I contacted the Firebase Auth team and this is the info I got from them:

For now developers cannot override the default password rules, nor can they set custom rules. As a hacky workaround, they can force the digit-only password on their own page, and prepend a fix string to the PIN before calling updatePassword() or createUserWithEmailAndPassword().

We have been thinking to support some kinds of regex rules, but never prioritized that feature.

So, it looks like you can work around this by pre-pending your PIN with a known string. But, the ability to override the default password rules is not available right now, although may become available in the future.

Cheers,

Jacob

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/1228eeb2-354f-4481-bf5d-946c0d30c173%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Zhelyazko Atanasov]

That was my idea as well - appending a fixed string at the start/end of user's pin. 

I only have to create a custom "Reset password" page - is there a sample project for a Reset password page anywhere ... or probably the current auto-generated one is open source?

Cheers,

Zheko

On Tuesday, 30 August 2016 22:18:01 UTC+3, Jacob Wenger wrote:

Hey Zhelyazko,

I contacted the Firebase Auth team and this is the info I got from them:

For now developers cannot override the default password rules, nor can they set custom rules. As a hacky workaround, they can force the digit-only password on their own page, and prepend a fix string to the PIN before calling updatePassword() or createUserWithEmailAndPassword().

We have been thinking to support some kinds of regex rules, but never prioritized that feature.

So, it looks like you can work around this by pre-pending your PIN with a known string. But, the ability to override the default password rules is not available right now, although may become available in the future.

Cheers,

Jacob

On Mon, Aug 29, 2016 at 10:39 AM, Zhelyazko Atanasov <jel...@gmail.com> wrote:

I'm exploring Firebase Authentication with username and password but I have a problem.

There seems to be built-in password rule - minimum length of 6 characters and if the password is not strong enough a FirebaseAuthWeakPasswordException is thrown.

Is it possible to turn off the built-in password restrictions? My app has something like a pin-based on-device only authentication and I'd like to use the already saved user pin as a firebase password. Thus I don't want a minimum length or strength enforcement from Firebase - I'd like to remove all Password-related exceptions and/or rules that are enforced by default by Firebase.

I'm also interested whether there is a way to set a custom password validation for the Reset password site that Firebase generates automatically? I'd like to force a digit-only password. Any idea how can I do this other than coding my own "Reset password" page?

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.