Skip to content

Fix issue where accounts:lookup is case-sensitive for emails#8351

Merged
joehan merged 1 commit intomasterfrom
aalej-auth-celookup
Mar 21, 2025
Merged

Fix issue where accounts:lookup is case-sensitive for emails#8351
joehan merged 1 commit intomasterfrom
aalej-auth-celookup

Conversation

@aalej
Copy link
Copy Markdown
Contributor

@aalej aalej commented Mar 21, 2025 •
edited
Loading

Description

Fixes #8344

Scenarios Tested

Verified that when connected to the Auth emulator, the 2 code snippets below output the same UserRecord

  1. All lowercase email
const admin = require('firebase-admin');

admin.initializeApp({
    projectId: "demo-project"
})

process.env.FIREBASE_AUTH_EMULATOR_HOST = "127.0.0.1:9099"

async function main() {
    try {
        const matchingCase = 'email@example.com';
        const user = await admin.auth().getUserByEmail(matchingCase); // Throws auth/user-not-found
        console.log(user);
    } catch (e) {
        console.error(e); 
    }
}

main()
  1. Random uppercases in email
const admin = require('firebase-admin');

admin.initializeApp({
    projectId: "demo-project"
})

process.env.FIREBASE_AUTH_EMULATOR_HOST = "127.0.0.1:9099"

async function main() {
    try {
        const nonMatchingCase = 'EmAiL@eXaMpLe.com';
        const user = await admin.auth().getUserByEmail(nonMatchingCase); // Throws auth/user-not-found
        console.log(user);
    } catch (e) {
        console.error(e); 
    }
}

main()

Sample Commands

Notes

AFAICT, all emails in the emulator are lowercased on signUp

firebase-tools/src/emulator/auth/operations.ts

Lines 204 to 207 in ee2e8b5

assert(isValidEmailAddress(reqBody.email), "INVALID_EMAIL");
const email = canonicalizeEmailAddress(reqBody.email);
assert(!state.getUserByEmail(email), "EMAIL_EXISTS");
updates.email = email;
. Verified this manually as well.

canonicalizeEmailAddress converts the string to all lower-case

firebase-tools/src/emulator/auth/utils.ts

Lines 69 to 71 in ee2e8b5

export function canonicalizeEmailAddress(email: string): string {
return email.toLowerCase();
}

github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 21, 2025
View reviewed changes
@aalej aalej requested a review from joehan March 21, 2025 15:57
joehan
joehan approved these changes Mar 21, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@joehan joehan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, emails are not case sensitive (https://mailchimp.com/resources/are-email-addresses-case-sensitive/#:~:text=The%20short%20answer%20is%20no,or%20not%20letters%20are%20capitalized.) so this is pretty clearly the right behavior.

@joehan joehan merged commit 5264a78 into master Mar 21, 2025
55 checks passed
@joehan joehan deleted the aalej-auth-celookup branch March 21, 2025 16:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@joehan joehan joehan approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

admin.auth().getUserByEmail is case-insensitive against live data, but case-sensitive against emulator data

3 participants

@aalej @joehan @github-advanced-security