user.emailVerified doesn't change after clicking email verification link firebase

Question

After learning sending email verification is possible in latest firebase, although the docs are missing that, I wanted to test it for myself.

Using the snippet below:

  Auth.$onAuthStateChanged(function(firebaseUser) {
    if (firebaseUser) {
      console.log(firebaseUser);
      if (firebaseUser.emailVerified) {
        // console.log(firebaseUser.emailVerified); 
        toastr.success('Email verified');
      } else {
        toastr.info('Do verify email');
      }
    }
  })

The console.log(firebaseUser.emailVerified) returns false, always, although a send verification was initiated, email received, and clicked on.

Right after login with email, I check to see if user is verified, if not, email should be sent:

Auth.$signInWithEmailAndPassword(email, password)
  .then(function(firebaseUser) {
    if (!firebaseUser.emailVerified) {
      firebaseUser.sendEmailVerification();
      console.log('Email verification sent');
    }
    $state.go('home');
  })

Under my https://console.firebase.google.com/project/my-app-name/authentication/emails, everything is by default, with a verify link as:

Follow this link to verify your email address. https://my-app-name.firebaseapp.com/__/auth/handler?mode=<action>&oobCode=<code>

The email I use to sign up receives the verify email message, yet, clicking the link does nothing to change the user.emailVerified to true.

Are the steps outline here all there is, or there's yet another step not found in the docs?

Solution 1

As mentioned by Tope in a comment, you need to do a firebaseUser.reload() in order for the change to the firebaseUser's authentication status to be updated.

Solution 2

I just took the same steps:

auth.currentUser.emailVerified

false

auth.currentUser.sendEmailVerification()

1. wait for the email
2. click the link in the email
3. sign out
4. sign in again

And then

auth.currentUser.emailVerified

true

Note step 3 and 4: I needed to sign in again, before the new value of emailVerified was visible in my app.

This answer also seems relevant, but I only spotted it after writing the above: Firebase confirmation email not being sent

Solution 3

In a very minimalistic way, this is what I ended up with:

angular.module('theApp')

.controller('emailVerifyController', ['$scope', '$stateParams', 'currentAuth', 'DatabaseRef',
  function($scope, $stateParams, currentAuth, DatabaseRef) {
    // where currentAuth and DatabaseRef is what they sound like
    $scope.doVerify = function() {
      firebase.auth()
        .applyActionCode($stateParams.oobCode)
        .then(function(data) {

          // change emailVerified for logged in User
          // you can update a DatabaseRef endpoint in here
          // whatever!

          toastr.success('Verification happened', 'Success!');
        })
        .catch(function(error) {
          $scope.error = error.message;
          toastr.error(error.message, error.reason, { timeOut: 0 });
        })
    };
  }
])

Then in template, something like this:

<a ng-click="doVerify()" class="button large">Verify my Account</a>

Although the applyActionCode is not yet wrapped for AngularFire, you could still drop down to vanilla Javascript of the SDK in your AngularJS stuff, besides, why not!

I share more details for Email Verification in Firebase:
https://blog.khophi.co/email-verification-firebase-3-0-sdk/

Solution 4

We have just gone through the same issue and found the fix was to both reload user using user.reload() function and to also change the observer from onAuthStateChanged to onIdTokenChanged.

This is because you are updating the firebase token with the new emailVerifed property and onIdTokenChanged is listening for changes to the Id token and updates the user object with the correct values.

Code snippets:

export function* register_user(action) {
  try {
    //Call api which registers user and sets email verified to true
    let register_result = yield call(Register_API.create_registration, action.data)

    if (register_result && register_result.status >= 200 && register_result.status < 300) {
      let user = firebase.auth().currentUser
      //Force user to reload so we can trigger the onIdTokenChanged listener
      return user.reload()
    }

  } catch (e) {
    console.error(e)
  }
}


firebase.auth().onIdTokenChanged(function (user) {
      if (user && user.uid) {
        if (user.emailVerified) {
         //Stuff you want to do
        }
      }
    })

Solution 5

In my case, it seems currentUser.emailVerified switches to true, but not always. Not sure why. It switches to true with Chrome in most cases, but not always. It does not with Firefox.

Applying the reload() method seemed to fix the issue.

I have the following in a saga, after loading the URL that contains the oobCode :

const currentUser = firebase.auth().currentUser;
if(currentUser){
  currentUser.reload();
}

View more solutions

Comments

[KhoPhi]

On that note, then I don't need to do what is said here, as in applying the code? firebase.google.com/docs/reference/js/…

[KhoPhi]

The thread from here: groups.google.com/d/msg/firebase-talk/EGYwg2vjRq4/0KXEhucLAQ‌​AJ touches on the use of the applyActionCode, however, what I'm wondering if that is still needed or the verification now happens automatically

[Mohammedsalim Shivani]

It would be helpful if you share your code snippet or some sample code for others to refer.

[carinlynchin]

I actually tried this and it still shows as false for email verified.

[Bhupiister singh]

@carinlynchin If you are still looking for solution, please let me know, maybe I can look into your code and help you.

[Madura Pradeep]

worked with both await auth().currentUser.reload(); await auth().currentUser.getIdToken(true)

[carinlynchin]

i ended up not using it... i was trying to use the action url... so I just took that out and the verify worked... it was for reactnative version

[Nihad Delic]

Yes, but when you will reload? How do you know that the user has visited the link in an email?

[Harry Scheuerle]

current user reload didn't work for me but the get token refresh did. Might be api version though since we're kinda out of date unfortunately

[myworldbox]

Maybe add a time expiration after 15 minutes?