Firebaseui-ios: Enforce mandatory email verification

[alfongj]

It should be possible to require an email to be verified in order for a user to successfully sign-in with email and password.

[alfongj]

Status: working with UX on mocks and flows for this.

[meirf]

@drishi94 can you give us a broad timeline on this feature? My impression from the amount of hits on this page is that it's in high demand.

[morganchen12]

@yramanchuk @drishi94 do you have any updates on this?

[drishi94]

Hi meirf and Morgan - unfortunately I can't give an update here right now as we have been working on a few other things that we believed may be higher priority. I can update this thread once we resume our UX and design work on mandatory email verification. I apologize for the delay

[sai-prasanna]

@drishi94 Any update on this?

[delingren]

I was doing research on using Firebase auth and ran into this issue. It looks like it's an old issue. Has it not been resolved yet? Thanks.

[tndttan]

I believe this issue should be looked at more closely, because it may have some security implications. Let me illustrate:

1. Create a new email-password account. At the moment, we can use any email and any password we want. Say for some reason, by mistake, on purpose, or as a victim of phishing, the user chooses an email that does not belong to them, say [email protected].
2. The user starts creating and uploading data into their account.
3. Sometime in the future, using the same app, the real owner of [email protected], who has an account with Google using that email address, logs in using the Google provider. Immediately, the real owner has taken full control of the account. The original user that used the email sign-in method no longer has any access.

EDIT: The above scenario only applies to multiple users using the same device

I think this problem is related to issue #579, Observed Results part B).