Password reset flow in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after calling sendPasswordResetEmail()?

In Firebase Authentication, when you call sendPasswordResetEmail() with a user's email, what is the immediate behavior of the service?

Firebase

firebase.auth().sendPasswordResetEmail(userEmail);

A The service returns the user's current password in the response.

B The user's password is reset automatically without user interaction.

C The user immediately receives a password reset email if the email exists in the system.

D The user's account is deleted if the email is invalid.

💡 Hint

Think about what a password reset email is supposed to do.

Calling sendPasswordResetEmail() triggers Firebase to send an email to the user with a link to reset their password. The password is not changed automatically, and no password data is returned.

❓ security

intermediate

Which security risk is prevented by Firebase password reset flow?

Firebase password reset flow includes sending a reset link to the user's email. Which security risk does this flow primarily prevent?

A Unauthorized password changes without email access.

B Brute force attacks on user passwords.

C Man-in-the-middle attacks during login.

D Data leakage from user profile information.

💡 Hint

Consider what access is required to reset a password.

The reset link is sent to the user's email, so only someone with access to that email can change the password, preventing unauthorized changes.

❓ Configuration

advanced

Which Firebase config setting controls the password reset email template?

To customize the password reset email sent by Firebase, which configuration setting must you modify in the Firebase Console or via API?

A Authentication > Templates > Password reset email

B Storage > Email Templates > Reset

C Firestore > Rules > Password reset

D Functions > Environment Variables > ResetEmail

💡 Hint

Think about where email templates are managed in Firebase.

Firebase Authentication section includes email templates for password reset, verification, and welcome emails.

❓ Architecture

advanced

What is the best architecture to handle password reset link clicks securely?

When a user clicks the password reset link sent by Firebase, what is the recommended architecture to securely handle the reset process?

A Redirect the user to a public static page without verification.

B Use Firebase Hosting to serve a secure page that verifies the reset code and allows password entry.

C Send the reset code to a backend server that resets the password without user input.

D Allow password reset directly from the email client without visiting a web page.

💡 Hint

Consider how to verify the reset code and collect the new password safely.

Firebase Hosting can serve a secure page that uses Firebase SDK to verify the reset code and let the user enter a new password safely.

✅ Best Practice

expert

Which practice improves security for Firebase password reset flow?

To improve security in Firebase password reset flow, which practice is recommended?

A Allow unlimited password reset attempts without rate limiting.

B Send reset links without verifying the user's email exists.

C Disable multi-factor authentication during password reset.

D Set a short expiration time for password reset links.

💡 Hint

Think about limiting the window of opportunity for attackers.

Short expiration times reduce the risk of reset links being used maliciously after a long time.