Firebaseui-web: Require username, password and two factor authentication every sign in

[JarmoKukkola]

Version
firebase 4.8.0
firebaseui 2.5.1
Ionic 3.9.2

Observed behaviour

1, User logs in with Google account in FirebaseUI-web

1. User logs out firebase.auth().signOut()
2. User goes back to firebaseUi and can login with previously used Google account without passport prompt or two factor authentication, even if I switch off "Don't ask again on this computer." from two factor authentication prompt. (Huge security risk, for example, in internet cafes)

Desired behaviour

1. User logs in with Google account in FirebaseUI-web
2. User logs out firebase.auth().signOut()
3. User goes back to firebaseUi, user has to write email, password ( and two factor authentication, if enabled).

Current implementation

ionViewDidLoad(){
  this.ui = firebaseui.auth.AuthUI.getInstance();
  this.ui = new firebaseui.auth.AuthUI(firebase.auth());
  this.ui.disableAutoSignIn();
  this.ui.start('#firebaseui-auth-container', this.getUiConfig());
}

getUiConfig() {
  return {
    callbacks: {
      signInSuccess: (currentUser, credential, redirectUrl) => {
        this
          .navCtrl
          .setRoot('OverviewPage');
        return false;
      }
    },
    signInOptions: [
      {
        provider: firebase.auth.GoogleAuthProvider.PROVIDER_ID,
        customParameters: {
          prompt: 'select_account' //without this user does not even have to choose used account
        }
      }
    ],
    credentialHelper: firebaseui.auth.CredentialHelper.NONE, //seems to have no effect
    tosUrl: '<your-tos-url>'
  };

[bojeil-google]

Firebase Auth does not support multi-factor authentication. FirebaseUI cannot support this feature until the underlying SDK supports it. For 2-factor auth, 2 credentials need to be passed to get a Firebase ID token. Currently, one is enough to get an ID token. Please file an official request for multi-factor auth with Firebase support: https://firebase.google.com/support/

[JarmoKukkola]

Thanks you for quick answer. Multi-factor authentication itself works fine with Google account and FirebaseUI, if it is enabled from Google settings (https://myaccount.google.com/signinoptions/two-step-verification/enroll-welcome).

However, the problem enables logging in without re-entering username and password even if the user has logged out.

[bojeil-google]

This works as expected (all OAuth providers work like that). If you want to sign out from Google, you have to do it separately, on Firebase sign out, you need to redirect to the google sign out URL: https://accounts.google.com/Logout

[JarmoKukkola]

Thank you so much for the help. It solved my problem.

Could you, please, add this to the docs? I think that some other developers might be interested in your solution also. You can even logout and redirect to your desired web address with the following link:

https://www.google.com/accounts/Logout?continue=https://www.google.com