Unknown user in my firebase user authentication (Flutter/firebase)

Question

I developed an app to test the google login feature using flutter and google authentication. The project is a closed project and only I have access to it. But recently I saw that there was a google sign in from an unknown Email ID. How did the user login without the build of my app? Has my account been hacked? What is going on?

Solution 1

Anyone with knowledge of your project's API Keys can access your Firebase Project using simple CURL Commands.

This is why it's a good idea to add restriction to those API Keys

In case you haven't, go to https://console.cloud.google.com and

1. Select your project
2. Click the menu icon at the top left (hamburger icon)
3. Go to API & Services and then credentials

You can view the APIs for your Google Cloud Project (linked to your Firebase Project) and then set restrictions for the API keys, refresh them or restrict access to specific platforms like Android or iOS.

You can also set restrictions on which components of Firebase the API key is allowed to access. For example, if your project doesn't require the use of Cloud Firestore, you can ensure that the API Key cannot be used to make calls to the Firestore Database

All said and done, I would still recommend that you shoot a mail to the Firebase Support team at https://firebase.google.com/support/troubleshooter/contact

Solution 2

To anyone still wondering about this:

If you provide a native google sign in and the registered email adresses look like this:

• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]

they are probably test accounts used to generate Google Plays Pre-Launch reports. You can read about it in the Play Console Help here.

If your app has a sign-in screen and you want the crawler to test the sign-in process or the content behind it, you need to provide account credentials.

Note that you do not need to provide credentials if your app supports "Sign-in with Google,” which enables the crawler to log in automatically.

Comments

[CoderUni]

I dont think you got hacked. Just delete him. If you really want to change your password you can.

[Damandroid]

I just faced the same problem. I actully had like 56 Unknown email addresses registered under the "user' tab under Authentication heading in my firebase console. Anyone knows why or how this can happen?

[kpvsrkp]

I am also facing the same issue. Please help if any update in this regard.

[to_sam]

Same here. Any news on this?

[Hari Aditya]

Firebase has released a feature titled 'Firebase AppCheck'. This is something you should definitely have a look at since it addresses this exact issue. firebase.google.com/docs/app-check