Password reset flow in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after calling sendPasswordResetEmail()?

In Firebase Authentication, when you call sendPasswordResetEmail() with a user's email, what is the immediate behavior of the service?

Firebase

firebase.auth().sendPasswordResetEmail(userEmail);

A The service returns the user's current password in the response.

B The user's password is reset automatically without user interaction.

C The user immediately receives a password reset email if the email exists in the system.

D The user's account is deleted if the email is invalid.

💡 Hint

Think about what a password reset email is supposed to do.

Calling sendPasswordResetEmail() triggers Firebase to send an email to the user with a link to reset their password. The password is not changed automatically, and no password data is returned.

❓ security

intermediate

Which security risk is prevented by Firebase password reset flow?

Firebase password reset flow includes sending a reset link to the user's email. Which security risk does this flow primarily prevent?

A Unauthorized password changes without email access.

B Brute force attacks on user passwords.

C Man-in-the-middle attacks during login.

D Data leakage from user profile information.

💡 Hint

Consider what access is required to reset a password.

The reset link is sent to the user's email, so only someone with access to that email can change the password, preventing unauthorized changes.

❓ Configuration

advanced

Which Firebase config setting controls the password reset email template?

To customize the password reset email sent by Firebase, which configuration setting must you modify in the Firebase Console or via API?

A Authentication > Templates > Password reset email

B Storage > Email Templates > Reset

C Firestore > Rules > Password reset

D Functions > Environment Variables > ResetEmail

💡 Hint

Think about where email templates are managed in Firebase.

Firebase Authentication section includes email templates for password reset, verification, and welcome emails.

❓ Architecture

advanced

What is the best architecture to handle password reset link clicks securely?

When a user clicks the password reset link sent by Firebase, what is the recommended architecture to securely handle the reset process?

A Redirect the user to a public static page without verification.

B Use Firebase Hosting to serve a secure page that verifies the reset code and allows password entry.

C Send the reset code to a backend server that resets the password without user input.

D Allow password reset directly from the email client without visiting a web page.

💡 Hint

Consider how to verify the reset code and collect the new password safely.

Firebase Hosting can serve a secure page that uses Firebase SDK to verify the reset code and let the user enter a new password safely.

✅ Best Practice

expert

Which practice improves security for Firebase password reset flow?

To improve security in Firebase password reset flow, which practice is recommended?

A Allow unlimited password reset attempts without rate limiting.

B Send reset links without verifying the user's email exists.

C Disable multi-factor authentication during password reset.

D Set a short expiration time for password reset links.

💡 Hint

Think about limiting the window of opportunity for attackers.

Short expiration times reduce the risk of reset links being used maliciously after a long time.

Practice

1. What does the Firebase function sendPasswordResetEmail do?

easy

A. Sends an email to the user to reset their password

B. Changes the user's password immediately

C. Deletes the user's account

D. Creates a new user account

Solution

1. Step 1: Understand the function purpose

   The function sendPasswordResetEmail is designed to send an email to the user with a link to reset their password.

2. Step 2: Differentiate from other actions

   This function does not change the password directly or affect the account status; it only initiates the reset process by sending an email.

3. Final Answer:

   Sends an email to the user to reset their password -> Option A

4. Quick Check:

   sendPasswordResetEmail = Sends reset email [OK]

Hint: Remember: sendPasswordResetEmail only sends the reset link [OK]

Common Mistakes:

• Thinking it changes the password immediately
• Confusing it with account deletion
• Assuming it creates a new user

2. Which of the following is the correct syntax to send a password reset email in Firebase using JavaScript?

easy

A. firebase.auth().sendPasswordResetEmail(email)

B. firebase.auth.sendPasswordResetEmail(email)

C. firebase.auth().sendPasswordReset(email)

D. firebase.auth().resetPasswordEmail(email)

Solution

1. Step 1: Recall the correct Firebase method

   The correct method to send a password reset email is sendPasswordResetEmail called on the auth object.

2. Step 2: Check method call syntax

   The auth object is accessed by firebase.auth(), so the full call is firebase.auth().sendPasswordResetEmail(email).

3. Final Answer:

   firebase.auth().sendPasswordResetEmail(email) -> Option A

4. Quick Check:

   Correct method call syntax = firebase.auth().sendPasswordResetEmail(email) [OK]

Hint: Remember auth() must be called as a function before methods [OK]

Common Mistakes:

• Omitting parentheses after auth
• Using wrong method names like sendPasswordReset
• Swapping method words order

3. Consider this code snippet:

firebase.auth().sendPasswordResetEmail('[e-mail]')
  .then(() => console.log('Email sent'))
  .catch(error => console.log(error.message));

What will be printed if the email is successfully sent?

medium

A. Error message

B. Nothing

C. undefined

D. Email sent

Solution

1. Step 1: Analyze the promise resolution

   The sendPasswordResetEmail returns a promise that resolves when the email is sent successfully.

2. Step 2: Check the then and catch handlers

   On success, the then callback logs 'Email sent'. On failure, the catch logs the error message.

3. Final Answer:

   Email sent -> Option D

4. Quick Check:

   Success logs 'Email sent' [OK]

Hint: Success triggers then(), failure triggers catch() [OK]

Common Mistakes:

• Confusing catch output with success
• Expecting no output on success
• Misreading promise behavior

4. You wrote this code but the password reset email never arrives:

firebase.auth.sendPasswordResetEmail('[e-mail]')

What is the likely error?

medium

A. Email address is invalid

B. Missing parentheses after auth()

C. sendPasswordResetEmail is not a Firebase method

D. No internet connection

Solution

1. Step 1: Check method call syntax

   The code calls firebase.auth.sendPasswordResetEmail without parentheses after auth, which is incorrect.

2. Step 2: Understand correct usage

   The correct call is firebase.auth().sendPasswordResetEmail(email) because auth is a function that returns the auth object.

3. Final Answer:

   Missing parentheses after auth() -> Option B

4. Quick Check:

   auth() must be called as a function [OK]

Hint: Always call auth() with parentheses before methods [OK]

Common Mistakes:

• Omitting parentheses after auth
• Assuming method names are wrong
• Ignoring syntax errors

5. You want to implement a password reset flow that shows a success message only if the email was sent, and an error message otherwise. Which code snippet correctly achieves this?

hard

A. firebase.auth().sendPasswordResetEmail(email)
.then(() => alert('Failed to send email'))
.catch(() => alert('Reset email sent'))

B. firebase.auth().sendPasswordResetEmail(email)
.catch(() => alert('Reset email sent'))
.then(() => alert('Failed to send email'))

C. firebase.auth().sendPasswordResetEmail(email)
.then(() => alert('Reset email sent'))
.catch(() => alert('Failed to send email'))

D. firebase.auth().sendPasswordResetEmail(email)
.finally(() => alert('Reset email sent'))

Solution

1. Step 1: Understand promise handlers order

   The then handler runs on success, and catch runs on failure.

2. Step 2: Match messages to handlers

   Success should show 'Reset email sent', failure should show 'Failed to send email'. Only firebase.auth().sendPasswordResetEmail(email) .then(() => alert('Reset email sent')) .catch(() => alert('Failed to send email')) matches this logic correctly.

3. Final Answer:

   firebase.auth().sendPasswordResetEmail(email) .then(() => alert('Reset email sent')) .catch(() => alert('Failed to send email')) -> Option C

4. Quick Check:

   then() = success, catch() = error [OK]

Hint: Use then() for success, catch() for errors [OK]

Common Mistakes:

• Swapping then and catch handlers
• Using finally for success message
• Showing error message on success