Firebase v9 - onAuthStateChanged randomly called with incorrect emailVerified using 'firebase/compat/auth'

[VincentCtr]

Hello,

We recently updated firebase to firebase 9 and we have some issues with onAuthStateChanged callback. We are still using compat libraries for now.

Sometime onAuthStateChanged is triggered for a connected user with incorrect information for emailVerified property/

A simple way to reproduce the bug is to log in and then log user.emailVerified when onAuthStateChanged is updated.

firebaseAuth.onAuthStateChanged((user) => {
   console.log(user.emailVerified)
})

You will find out that this will log "false" for a verified user after a few minutes/hours. This issue seems to happen more frequently when I have connexion stability issues. I could not find a way to reproduce it without waiting...

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[laurentpayot]

@VincentCtr see #2529. I had to use onIdTokenChanged instead of onAuthStateChanged.

[jbalidiong]

Hi @VincentCtr, thanks for reporting this behavior. I tried replicating, but I wasn't able to reproduce the same behavior. I also try turning off my network, then turning it back on again after a few minutes to replicate the connection stability issue but it always return the correct value for the emailVerified property. Here is the snippet I used:

auth.onAuthStateChanged((user) => {
  if (user) {
    console.log("User is signed in");
    console.log(user.emailVerified)
  } else {
    // User is signed out
    console.log("User is signed out");
  }
})

I verified that it is working fine on v9.0.0. If I can replicate the issue, I can have a better look into it. Please share a minimal, but complete sample of a project that I can run locally.

[VincentCtr]

@laurentpayot
I am not sure that it is the same issue here. I don't need a callback when the user verify its email, this part works great on our application. In my case onAuthStateChanged is randomly called with incorrect informations.

@jbalidiong
Thank you for your answer. I did not find a way to reproduce it yet but I will do my best to reproduce it and share a minimal project.

[sam-gc]

@VincentCtr a reproducible example would be ideal, but in the mean time, could you share a few more details? What browsers/platforms are you seeing this on?

[VincentCtr]

@sam-gc :
We have a react application and the behaviour of the react-router is linked to the verifyEmail status.
When onAuthStateChanged callback is fired with a false value for verifyEmail user will be redirected to a page that display "Please, verify your email".

I can see that a lot of users have the issue by looking to our google analytics, here is the number of page view for the page "verify your email". We can see a sharp increase following our recent update to firebase 9.

I was able to log the user object when the callback was wrongly fired on my local environment and could check the "verifyEmail" was the issue :

On this screenshot this user is supposed to be verified. I am on mac os x / chrome 92.0.4515.159 / firebase 9.0.0

We are using firebase 9.0.0 and this is how we start the listener (the code is simplified).

import app from 'firebase/compat/app';
export let firebaseApp;

firebaseApp = app.initializeApp(FIREBASE_CONFIG);
firebaseAuth = firebaseApp.auth();

firebaseAuth.onAuthStateChanged((user) => {
console.log(user)
}

[jbalidiong]

I tried following the same code as you've provided and still I'm not experiencing the same behavior. Similar to what I've done before, I tried logging in and out, turning off the network to replicate the connection stability but I still received the correct value for emailVerified.

I'll wait for a reproducible example to help me further check on this.

[VincentCtr]

Hi @jbalidiong
Thank you for your time and sorry that you were not able to reproduce. I would understand if you close this issue. I will post a reproductible exemple if I manage to do it.
In the meantime we are trying to remove the compat library and we hope that it will fix this issue.

[jbalidiong]

I'll be closing this for now. If you're still experiencing the issue, feel free to reopen this and provide the MCVE to help me investigate.

[VincentCtr]

Hi @jbalidiong Good news, I found a way to reproduce the bug using the code above :

import app from 'firebase/compat/app';
export let firebaseApp;

firebaseApp = app.initializeApp(FIREBASE_CONFIG);
firebaseAuth = firebaseApp.auth();

firebaseAuth.onAuthStateChanged((user) => {
console.log(user)
}

1. Be sure to not be connected and open 2 tabs of your application in chrome
2. Connect to your verified account in the first tab
3. Have a look to the log in on the the second tab : you will see that the the onAuthStateChanged function is fired and the value for "verifiedEmail" is false.

[schTi]

We are experiencing the exact same issue, which is super annoying. As @VincentCtr said, it really looks like this happens, when having multiple tabs open at the same time. When having two tabs open, and logging into one, the emailVerified field is getting set to false after a few seconds, whereas it stays true, when having only one tab. Would be great, if you could investigate this further

[sam-gc]

Thanks everyone for the detailed feedback. I've been able to reproduce and this is definitely a bug. A fix is underway!

[jacob-buscher]

@sam-gc We're experiencing this issue as well, awesome to see a fix is on the way, thank you.

ETA on when it may be deployed to NPM? We may need to revert back to 8.

[sam-gc]

@jacob-buscher the fix is now merged, so it should be in the next release