Unverified users could login to app. How to prevent it?

up vote
1
down vote

favorite

The verification implemented well, and i get the relevant email, but even when
i do not click on verification link, i succeed to login to my app.

How can i fix it, please?

My verification implementation is like this:

final FirebaseUser user = mAuth.getCurrentUser();



        if (user.isEmailVerified())

        {

            Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

        } else

        {

            Toast.makeText(this, "Email is not verified", Toast.LENGTH_SHORT).show();

            user.sendEmailVerification()

                    .addOnCompleteListener(this, new OnCompleteListener() {

                        @Override

                        public void onComplete(@NonNull Task task) {

                            // Re-enable button

                            //  findViewById(R.id.verify_email_button).setEnabled(true);



                            if (task.isSuccessful()) {

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,"Verification email sent to " + user.getEmail(), Toast.LENGTH_LONG).show();

                            } else {

                                Log.e(TAG, "sendEmailVerification", task.getException());

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,  "Failed to send verification email.",

                                        Toast.LENGTH_LONG).show();

                            }

                        }

                    });

        }

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

add a comment |

up vote
1
down vote

favorite

The verification implemented well, and i get the relevant email, but even when
i do not click on verification link, i succeed to login to my app.

How can i fix it, please?

My verification implementation is like this:

final FirebaseUser user = mAuth.getCurrentUser();



        if (user.isEmailVerified())

        {

            Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

        } else

        {

            Toast.makeText(this, "Email is not verified", Toast.LENGTH_SHORT).show();

            user.sendEmailVerification()

                    .addOnCompleteListener(this, new OnCompleteListener() {

                        @Override

                        public void onComplete(@NonNull Task task) {

                            // Re-enable button

                            //  findViewById(R.id.verify_email_button).setEnabled(true);



                            if (task.isSuccessful()) {

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,"Verification email sent to " + user.getEmail(), Toast.LENGTH_LONG).show();

                            } else {

                                Log.e(TAG, "sendEmailVerification", task.getException());

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,  "Failed to send verification email.",

                                        Toast.LENGTH_LONG).show();

                            }

                        }

                    });

        }

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

add a comment |

up vote
1
down vote

favorite

The verification implemented well, and i get the relevant email, but even when
i do not click on verification link, i succeed to login to my app.

How can i fix it, please?

My verification implementation is like this:

final FirebaseUser user = mAuth.getCurrentUser();



        if (user.isEmailVerified())

        {

            Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

        } else

        {

            Toast.makeText(this, "Email is not verified", Toast.LENGTH_SHORT).show();

            user.sendEmailVerification()

                    .addOnCompleteListener(this, new OnCompleteListener() {

                        @Override

                        public void onComplete(@NonNull Task task) {

                            // Re-enable button

                            //  findViewById(R.id.verify_email_button).setEnabled(true);



                            if (task.isSuccessful()) {

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,"Verification email sent to " + user.getEmail(), Toast.LENGTH_LONG).show();

                            } else {

                                Log.e(TAG, "sendEmailVerification", task.getException());

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,  "Failed to send verification email.",

                                        Toast.LENGTH_LONG).show();

                            }

                        }

                    });

        }

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

The verification implemented well, and i get the relevant email, but even when
i do not click on verification link, i succeed to login to my app.

How can i fix it, please?

My verification implementation is like this:

final FirebaseUser user = mAuth.getCurrentUser();



        if (user.isEmailVerified())

        {

            Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

        } else

        {

            Toast.makeText(this, "Email is not verified", Toast.LENGTH_SHORT).show();

            user.sendEmailVerification()

                    .addOnCompleteListener(this, new OnCompleteListener() {

                        @Override

                        public void onComplete(@NonNull Task task) {

                            // Re-enable button

                            //  findViewById(R.id.verify_email_button).setEnabled(true);



                            if (task.isSuccessful()) {

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,"Verification email sent to " + user.getEmail(), Toast.LENGTH_LONG).show();

                            } else {

                                Log.e(TAG, "sendEmailVerification", task.getException());

                                Toast.makeText(AccountTypeActivity.this//EmailPasswordActivity.this

                                        ,  "Failed to send verification email.",

                                        Toast.LENGTH_LONG).show();

                            }

                        }

                    });

        }

android firebase firebase-authentication email-verification

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

edited Nov 11 at 15:33

Frank van Puffelen

222k25363389

asked Nov 11 at 14:01

Dima Bokov

298

asked Nov 11 at 14:01

Dima Bokov

298

asked Nov 11 at 14:01

Dima Bokov

298

add a comment |

1 Answer
1

active

oldest

votes

up vote
1
down vote

Ok, i'm a stupid.
The solution is to put this if else to login page...
Did it, and all is works!!!

   if (user.isEmailVerified())

            {

                Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

 openmainactivity();

            } else

            {

    Toast.makeText(this, "Verify your email!!", Toast.LENGTH_SHORT).show();

    mauth.signout();

    }

answered Nov 11 at 14:24

Dima Bokov

298

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53249499%2funverified-users-could-login-to-app-how-to-prevent-it%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
1
down vote

Ok, i'm a stupid.
The solution is to put this if else to login page...
Did it, and all is works!!!

   if (user.isEmailVerified())

            {

                Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

 openmainactivity();

            } else

            {

    Toast.makeText(this, "Verify your email!!", Toast.LENGTH_SHORT).show();

    mauth.signout();

    }

answered Nov 11 at 14:24

Dima Bokov

298

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

add a comment |

up vote
1
down vote

Ok, i'm a stupid.
The solution is to put this if else to login page...
Did it, and all is works!!!

   if (user.isEmailVerified())

            {

                Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

 openmainactivity();

            } else

            {

    Toast.makeText(this, "Verify your email!!", Toast.LENGTH_SHORT).show();

    mauth.signout();

    }

answered Nov 11 at 14:24

Dima Bokov

298

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

add a comment |

up vote
1
down vote

Ok, i'm a stupid.
The solution is to put this if else to login page...
Did it, and all is works!!!

   if (user.isEmailVerified())

            {

                Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

 openmainactivity();

            } else

            {

    Toast.makeText(this, "Verify your email!!", Toast.LENGTH_SHORT).show();

    mauth.signout();

    }

answered Nov 11 at 14:24

Dima Bokov

298

Ok, i'm a stupid.
The solution is to put this if else to login page...
Did it, and all is works!!!

   if (user.isEmailVerified())

            {

                Toast.makeText(this, "Email is verified", Toast.LENGTH_SHORT).show();

 openmainactivity();

            } else

            {

    Toast.makeText(this, "Verify your email!!", Toast.LENGTH_SHORT).show();

    mauth.signout();

    }

answered Nov 11 at 14:24

Dima Bokov

298

answered Nov 11 at 14:24

Dima Bokov

298

answered Nov 11 at 14:24

Dima Bokov

298

answered Nov 11 at 14:24

Dima Bokov

298

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

add a comment |

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

Make sure you enforce access for verified emails in your server or security rules. Front end validation is not enough.
– bojeil
Nov 19 at 19:38

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Vfrdtyky