Firebase reset password with actionCodeSettings and Dynamic Link not opening up android app (invalid url)

[Brian Begun]

Hi All,

       my goal is to have users reset their password directly in my app as opposed to a web page.  Currently, I'm struggling to successfully get the user back to my forgot password activity after

they click the URL link in their email.

If I run my mAuth.sendPasswordResetEmail() method

without using the actionCodeSettings and any redirect, the password reset works as expected (resetting the password on a web page):

Example URL: https://xxxxx-00000.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=<redacted code>&apiKey=<redacted API KEY>&lang=en 

I setup the following and confirmed that they work:

Dynamic Link in Firebase console using a domain like: xxxx.page.link/resetPassword

(putting this in the browser on my Mac redirects properly to my website (myWebsite.com - demo only).

I also setup the intent in my AndroidManifest.xml file:

<intent-filter>
    <action android:name="android.intent.action.VIEW"/>
    <category android:name="android.intent.category.DEFAULT"/>
    <category android:name="android.intent.category.BROWSABLE"/>
    <data android:host="myWebsite.com" android:scheme="http"/>
    <data android:host="myWebsite.com" android:scheme="https"/>
</intent-filter>

I tested this inside android studio and it redirects to the proper app screen.

I also tested the Dynamic Link from above in a web browser on my phone and it also correctly opens

the app and redirects it to the proper app screen.

This is where things break down.

Here's my code to use actionCodeSettings to pass my dynamic link to the sendPasswordresetEmail() method:

String url = "https://xxxx.page.link/resetPassword";

ActionCodeSettings settings = ActionCodeSettings.newBuilder()
        .setAndroidPackageName(
                getPackageName(),
                true, /* install if not available? */
                null   /* minimum app version */)
        .setHandleCodeInApp(true)
        .setUrl(url)
        .build();

mAuth.sendPasswordResetEmail(email, settings)
        .addOnCompleteListener(new OnCompleteListener<Void>() {
            @Override
            public void onComplete(@NonNull Task<Void> task) {
                if (task.isSuccessful()) {
                    Log.d(TAG, "Email sent.");
                    hideProgressDialog();
                    Toast.makeText(ForgotPasswordActivity.this, getString(R.string.alert_passwordResetConfirm),
                            Toast.LENGTH_SHORT).show();
                }
                else {
                    Exception e = task.getException();
                    Log.w(TAG, "passwordResetRequest:failure " + e.getMessage(), task.getException());
                    hideProgressDialog();
                    Toast.makeText(ForgotPasswordActivity.this, e.getMessage(),
                            Toast.LENGTH_SHORT).show();
                }
            }
        });

When I execute the reset using the actionCodeSettings, this is an example URL that I get (which appears to be invalid - note: I redacted sensitive info):

https://xxxxx.app.goo.gl?link=https://xxxxx-00000.firebaseapp.com/__/auth/action?apiKey%3<redacted API KEY>%26mode%3DresetPassword%26oobCode%<Redacted code>%26continueUrl%3Dhttps://xxxx.page.link/resetPassword%26lang%3Den&apn=com.package.android

What I find weird is that the xxxxx.app.goo.gl domain is added to the front of this.  It exists on my list of domains in the Dynamic Links console page, but I don't have any dynamic links setup with it, only the one that is formatted like: xxxx.page.link.  If I remove the xxxxx.app.goo.gl domain from the beginning of the path and replace it with: xxxx.page.link/resetPassword then the redirect works.

I'm not sure if this is a bug or what.  I haven't been able to narrow this down any farther.   Please let me know if you need any further info.

Any help would be greatly appreciated.

Thanks in advance.

Best,

      Brian

[Brian Begun]

Some more info:

For the hell of it, I turned .setHandleCodeInApp(false) which should handle the password reset in the browser THEN

send the user to the app.  Well, the password reset worked, and there was a continue button.  But when I hit

the continue button I get an error web page.

Here's the link:

https://xxxxx-00000.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=<reset code redacted>&apiKey=<API code redacted>&continueUrl=https%3A%2F%2Fxxxxx.app.goo.gl%3Flink%3Dhttps%3A%2F%2Fxxxxxx.page.link%2FresetPassword%26apn%3Dcom.xxxxxx.xxxxxx&lang=en

A couple of notes:  the root path is my app's path  AND the big thing I'm seeing is the beginning of the continuUrl path is the other domain (xxxxxx.app.goo.gl) that I'm not using is put there before the domain I am using.  Again that domain is appearing in the Url and it shouldn't.  In no way I'm using that Domain, only that it appears on my domain list in the Firebase Dynamic links console.  

[Bassam]

Hey Brian, it looks like you are trying to use page.link FDL in an existing project with an app.goo.gl FDL domain.

Currently, for Auth operations, we have no way to determine which one to use. So we always use the oldest one set. We have ongoing plans to support this.

So for now to get this working, you need to use the existing app.goo.gl in your intent filter.

Best regards,

Bassam

[Brian Begun]

Okay.  So I re-read your post Bassam.  Apparently two things had to happen for it to work..  I had to use the xxxx.app.goo.gl/resetPass

in the actionCodeSettings AND I had to change the host: option in the intent-filter to be xxxx.app.goo.gl.

Wow!  That is so confusing.  Based upon everything I read, I need to put my dynamic link in the actionCodeSettings

either: xxxx.page.link/prefix or xxxx.app.goo.gl/prefix and in AndroidManifest.xml I need to put the deep link

in the host: field (inside intent-filter) which in my case would be my website (ie. mySite.com).

For it to work, I switched to use xxxx.app.goo.gl/resetPass in the actionCodeSettings .setUrl() option AND in the AndroidManifest.xml file

I changed host: (inside intent-filter) to be the domain part of the dynamic link: xxxx.app.goo.gl.

Did I miss something?  Did I read something wrong?