Email/password login in Firebase - Commands & Configuration

Introduction

Email/password login lets users sign into your app using their email and a secret password. It solves the problem of identifying users securely without needing social media or other accounts.

When you want users to create accounts with just an email and password.

When you need a simple way to authenticate users without external providers.

When you want to manage user access and permissions based on their login.

When you want to allow password resets and email verification easily.

When you want to keep user data safe with Firebase's secure authentication.

Config File - firebase.json

firebase.json

{
  "hosting": {
    "public": "public",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
    "rewrites": [
      {
        "source": "/api/**",
        "function": "api"
      }
    ]
  },
  "auth": {
    "signInOptions": [
      {
        "provider": "password"
      }
    ]
  }
}

This file configures Firebase Hosting and enables email/password sign-in under the auth.signInOptions section. The password provider allows users to register and login with email and password.

Commands

Log in to your Firebase account from the command line to allow deployment and management.

Terminal

firebase login

Expected Output

✔  Success! Logged in as [e-mail]

Initialize Firebase Authentication in your project to enable email/password login.

Terminal

firebase init auth

Expected Output

✔  Firebase Authentication has been set up in your project.

✔  Email/password sign-in method enabled.

Deploy the authentication configuration to Firebase so email/password login is active.

Terminal

firebase deploy --only auth

Expected Output

=== Deploying to 'your-project-id'...



✔  Deploy complete!



Project Console: https://console.firebase.google.com/project/your-project-id/overview

→

--only - Deploy only the specified Firebase feature, here 'auth' for authentication.

Sign in a user with their email and password to test the login functionality.

Terminal

firebase auth:signInWithEmailAndPassword [e-mail] mySecurePass123

Expected Output

{

  "uid": "some-unique-user-id",

  "email": "[e-mail]",

  "emailVerified": false,

  "isAnonymous": false

}

Key Concept

If you remember nothing else from this pattern, remember: email/password login lets users securely access your app with just their email and a secret password managed by Firebase.

Common Mistakes

Not enabling the email/password sign-in method in Firebase console or config.

Users cannot log in because Firebase rejects email/password authentication if not enabled.

Always enable the email/password provider in Firebase Authentication settings before deploying.

Using weak or common passwords during user registration.

Weak passwords increase risk of account compromise and reduce security.

Enforce strong password rules in your app and educate users to choose secure passwords.

Not handling errors from sign-in commands, like wrong password or unregistered email.

Your app may crash or behave unpredictably without proper error handling.

Always check and handle authentication errors gracefully in your app code.

Summary

Use 'firebase login' to authenticate your CLI with Firebase.

Initialize authentication with 'firebase init auth' to enable email/password login.

Deploy your auth settings using 'firebase deploy --only auth'.

Test user login with 'firebase auth:signInWithEmailAndPassword email password'.

Practice

1. What is the main purpose of using email/password login in Firebase?

easy

A. To allow users to create accounts and sign in securely

B. To store user data in a database

C. To send emails to users automatically

D. To host a website on Firebase

Solution

1. Step 1: Understand the feature purpose

   Email/password login lets users create accounts and sign in using their email and a password.

2. Step 2: Identify the correct use case

   This method is mainly for user authentication, not for storing data or sending emails.

3. Final Answer:

   To allow users to create accounts and sign in securely -> Option A

4. Quick Check:

   Email/password login = user sign-in [OK]

Hint: Email/password login is for user sign-in only [OK]

Common Mistakes:

• Confusing login with data storage
• Thinking it sends emails automatically
• Assuming it hosts websites

2. Which Firebase method is used to create a new user with email and password?

easy

A. firebase.auth().createUserWithEmailAndPassword(email, password)

B. firebase.auth().sendPasswordResetEmail(email)

C. firebase.auth().signInWithEmailAndPassword(email, password)

D. firebase.auth().signOut()

Solution

1. Step 1: Identify method for new user creation

   The method to create a new user is createUserWithEmailAndPassword.

2. Step 2: Differentiate from other methods

   signInWithEmailAndPassword is for login, sendPasswordResetEmail is for resetting password, signOut logs out the user.

3. Final Answer:

   firebase.auth().createUserWithEmailAndPassword(email, password) -> Option A

4. Quick Check:

   Create user method = createUserWithEmailAndPassword [OK]

Hint: Create user uses 'createUserWithEmailAndPassword' [OK]

Common Mistakes:

• Using signInWithEmailAndPassword to create users
• Confusing reset email with user creation
• Calling signOut instead of createUser

3. What will happen if you run this code snippet?

firebase.auth().signInWithEmailAndPassword('[e-mail]', 'wrongpass')
  .catch(error => console.log(error.code));

medium

A. Logs 'auth/user-not-found' error code

B. Logs 'auth/network-request-failed' error code

C. Logs 'auth/invalid-email' error code

D. Logs 'auth/wrong-password' error code

Solution

1. Step 1: Understand signInWithEmailAndPassword behavior

   This method tries to sign in with given email and password.

2. Step 2: Analyze error for wrong password

   If the email exists but password is wrong, Firebase returns 'auth/wrong-password'.

3. Final Answer:

   Logs 'auth/wrong-password' error code -> Option D

4. Quick Check:

   Wrong password error = 'auth/wrong-password' [OK]

Hint: Wrong password triggers 'auth/wrong-password' error [OK]

Common Mistakes:

• Assuming user-not-found error instead
• Confusing invalid email format error
• Thinking network error will occur

4. Identify the error in this Firebase email/password login code:

firebase.auth().signInWithEmailAndPassword(email, password)
  .then(userCredential => {
    console.log('User signed in:', userCredential.user);
  })
  .catch(error => {
    console.log('Error:', error.message);
  });

Assume email and password are not defined.

medium

A. Missing import of firebase module

B. Variables email and password are undefined

C. Incorrect method name used

D. No catch block for errors

Solution

1. Step 1: Check variable definitions

   The code uses email and password variables but they are not defined anywhere.

2. Step 2: Confirm method and error handling

   The method signInWithEmailAndPassword is correct and there is a catch block for errors.

3. Final Answer:

   Variables email and password are undefined -> Option B

4. Quick Check:

   Undefined variables cause runtime error [OK]

Hint: Always define email and password before use [OK]

Common Mistakes:

• Ignoring variable definitions
• Thinking method name is wrong
• Missing error handling block

5. You want to ensure users create strong passwords during Firebase email/password signup. Which approach is best?

hard

A. Use Firebase's built-in password strength validation only

B. Send password to server for manual strength checking after signup

C. Check password strength on client side before calling createUserWithEmailAndPassword

D. Allow any password and rely on Firebase error messages

Solution

1. Step 1: Understand Firebase password validation

   Firebase requires minimum 6 characters but does not enforce strong passwords by default.

2. Step 2: Implement client-side password strength check

   Checking password strength on client side before signup improves security and user experience.

3. Final Answer:

   Check password strength on client side before calling createUserWithEmailAndPassword -> Option C

4. Quick Check:

   Client-side validation = better password strength [OK]

Hint: Validate password strength before signup call [OK]

Common Mistakes:

• Relying only on Firebase's minimal checks
• Ignoring password strength until after signup
• Sending passwords to server for manual checks