Email/password login in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a user tries to sign in with an unregistered email?

Using Firebase Email/Password login, what is the expected behavior if a user attempts to sign in with an email that is not registered?

A Firebase signs in the user anonymously without a password.

B Firebase ignores the request and returns no response.

C Firebase automatically creates a new user with that email.

D Firebase returns an error indicating the user does not exist.

💡 Hint

Think about how Firebase handles sign-in attempts with unknown emails.

Firebase requires users to be registered before signing in. If the email is not found, it returns an error indicating the user does not exist.

❓ security

intermediate

Which Firebase rule protects user data from unauthorized access?

In Firebase Realtime Database or Firestore, which security rule ensures that users can only read and write their own data after email/password login?

A allow read, write: if request.auth.email_verified == false;

B allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;

C allow read, write: if request.time < timestamp.date(2025, 1, 1);

D allow read, write: if request.auth.token.admin == true;

💡 Hint

Consider how to restrict access to only the authenticated user's own data.

This rule checks that the user is authenticated and that their user ID matches the data's userId field, ensuring only owners access their data.

❓ Configuration

advanced

What is the correct Firebase config snippet to enable email/password sign-in?

Which configuration snippet correctly enables email/password sign-in method in Firebase Authentication?

A firebase.auth().enableEmailPassword(true);

B firebase.auth().settings.signInMethod = 'emailPassword';

C In Firebase Console, under Authentication > Sign-in method, enable Email/Password toggle.

D firebase.auth().useDeviceLanguage(); firebase.auth().signInWithEmailAndPassword(email, password);

💡 Hint

Think about where sign-in methods are enabled in Firebase.

Email/password sign-in is enabled via the Firebase Console under Authentication settings, not by code commands.

❓ Architecture

advanced

Which architecture best secures user passwords in Firebase Authentication?

How does Firebase Authentication handle user passwords to keep them secure?

A Passwords are hashed and salted securely by Firebase Authentication service.

B Passwords are stored in plain text in Firebase database for quick access.

C Passwords are encrypted on the client and sent as encrypted blobs to Firebase.

D Passwords are stored in user metadata fields accessible by developers.

💡 Hint

Consider industry best practices for password storage.

Firebase Authentication securely hashes and salts passwords internally, so developers never see raw passwords.

✅ Best Practice

expert

What is the recommended way to handle failed login attempts to prevent brute force attacks?

In Firebase Email/Password login, what is the best practice to protect against repeated failed login attempts?

A Use Firebase's built-in rate limiting and monitor suspicious activity via Firebase Console.

B Implement Firebase Authentication triggers to lock accounts after multiple failed attempts.

C Require users to change their password after every failed login attempt.

D Disable email/password login and only allow anonymous sign-in.

💡 Hint

Think about Firebase's native protections and monitoring tools.

Firebase Authentication includes built-in protections like rate limiting and provides monitoring tools to detect suspicious login attempts.

Practice

1. What is the main purpose of using email/password login in Firebase?

easy

A. To allow users to create accounts and sign in securely

B. To store user data in a database

C. To send emails to users automatically

D. To host a website on Firebase

Solution

1. Step 1: Understand the feature purpose

   Email/password login lets users create accounts and sign in using their email and a password.

2. Step 2: Identify the correct use case

   This method is mainly for user authentication, not for storing data or sending emails.

3. Final Answer:

   To allow users to create accounts and sign in securely -> Option A

4. Quick Check:

   Email/password login = user sign-in [OK]

Hint: Email/password login is for user sign-in only [OK]

Common Mistakes:

• Confusing login with data storage
• Thinking it sends emails automatically
• Assuming it hosts websites

2. Which Firebase method is used to create a new user with email and password?

easy

A. firebase.auth().createUserWithEmailAndPassword(email, password)

B. firebase.auth().sendPasswordResetEmail(email)

C. firebase.auth().signInWithEmailAndPassword(email, password)

D. firebase.auth().signOut()

Solution

1. Step 1: Identify method for new user creation

   The method to create a new user is createUserWithEmailAndPassword.

2. Step 2: Differentiate from other methods

   signInWithEmailAndPassword is for login, sendPasswordResetEmail is for resetting password, signOut logs out the user.

3. Final Answer:

   firebase.auth().createUserWithEmailAndPassword(email, password) -> Option A

4. Quick Check:

   Create user method = createUserWithEmailAndPassword [OK]

Hint: Create user uses 'createUserWithEmailAndPassword' [OK]

Common Mistakes:

• Using signInWithEmailAndPassword to create users
• Confusing reset email with user creation
• Calling signOut instead of createUser

3. What will happen if you run this code snippet?

firebase.auth().signInWithEmailAndPassword('[e-mail]', 'wrongpass')
  .catch(error => console.log(error.code));

medium

A. Logs 'auth/user-not-found' error code

B. Logs 'auth/network-request-failed' error code

C. Logs 'auth/invalid-email' error code

D. Logs 'auth/wrong-password' error code

Solution

1. Step 1: Understand signInWithEmailAndPassword behavior

   This method tries to sign in with given email and password.

2. Step 2: Analyze error for wrong password

   If the email exists but password is wrong, Firebase returns 'auth/wrong-password'.

3. Final Answer:

   Logs 'auth/wrong-password' error code -> Option D

4. Quick Check:

   Wrong password error = 'auth/wrong-password' [OK]

Hint: Wrong password triggers 'auth/wrong-password' error [OK]

Common Mistakes:

• Assuming user-not-found error instead
• Confusing invalid email format error
• Thinking network error will occur

4. Identify the error in this Firebase email/password login code:

firebase.auth().signInWithEmailAndPassword(email, password)
  .then(userCredential => {
    console.log('User signed in:', userCredential.user);
  })
  .catch(error => {
    console.log('Error:', error.message);
  });

Assume email and password are not defined.

medium

A. Missing import of firebase module

B. Variables email and password are undefined

C. Incorrect method name used

D. No catch block for errors

Solution

1. Step 1: Check variable definitions

   The code uses email and password variables but they are not defined anywhere.

2. Step 2: Confirm method and error handling

   The method signInWithEmailAndPassword is correct and there is a catch block for errors.

3. Final Answer:

   Variables email and password are undefined -> Option B

4. Quick Check:

   Undefined variables cause runtime error [OK]

Hint: Always define email and password before use [OK]

Common Mistakes:

• Ignoring variable definitions
• Thinking method name is wrong
• Missing error handling block

5. You want to ensure users create strong passwords during Firebase email/password signup. Which approach is best?

hard

A. Use Firebase's built-in password strength validation only

B. Send password to server for manual strength checking after signup

C. Check password strength on client side before calling createUserWithEmailAndPassword

D. Allow any password and rely on Firebase error messages

Solution

1. Step 1: Understand Firebase password validation

   Firebase requires minimum 6 characters but does not enforce strong passwords by default.

2. Step 2: Implement client-side password strength check

   Checking password strength on client side before signup improves security and user experience.

3. Final Answer:

   Check password strength on client side before calling createUserWithEmailAndPassword -> Option C

4. Quick Check:

   Client-side validation = better password strength [OK]

Hint: Validate password strength before signup call [OK]

Common Mistakes:

• Relying only on Firebase's minimal checks
• Ignoring password strength until after signup
• Sending passwords to server for manual checks