firebase auth is it possible to restrict login to some users? - firebase

Question

currently I have implemented a login function with firestore.
btnLogin.addEventListener('click', e => {
// Get email and password
const email = txtEmail.value;
const pass = txtPassword.value;
const auth = firebase.auth();
// Sign in
const promise = auth.signInWithEmailAndPassword(email, pass);
promise.catch(e => console.log(e.message));
})
I am wondering if it's possible to restrict the login to only a particular email, the only way I am thinking is manually checking for the email before authenticating - but wondering if there are any official ways of doing this. Even extended for more than one email.
My temporary solution (?)
btnLogin.addEventListener('click', e => {
// Get email and password
const email = txtEmail.value;
const pass = txtPassword.value;
const auth = firebase.auth();
// Sign in
if (email == "email_desired" | email == "email_desired2"){
const promise = auth.signInWithEmailAndPassword(email, pass);
promise.catch(e => console.log(e.message));
}
else{
console.log("Email is not accepted at login")
}
})
The purpose I am doing this is to only allow fixed users to access the admin login-panel.

Answer 1

In ur app, dont give option to create new user.
Only keep ur app limted to Login with email and password.
You cam manually create users on firebase web console.
This way only users u created will be able to login.

Answer 2

If you have email/password sign-in enabled, you can't stop people from trying to create accounts and signing in. What you've suggested in your question isn't really "security" since client code can be compromised and bypassed. However, you can use security rules to determine who can actually access your database. Since you tagged this google-cloud-firestore, I'll assume that's what you're using.
Firestore has security rules that you can use to determine who has access to what data. For an admin panel where you trust a certain set of accounts under your control (that you can create manually yourself), you can simply whitelist them in your rules. Assuming that you have a list of UIDs, the easiest thing to do, if you trust them all with any actions in the database, is simply give them all full access:
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.auth.uid in ['uid1', 'uid2', 'uid3'];
}
}
}
You might want something more sophisticated, in which case, you will really have to learn the security rules system and make the best use of it. Or, you can route all user actions through a backend you control, and verify the user's Firebase Auth ID token using the Firebase Admin SDK before committing the action.

Answer 3

You can block those users in firebase console by disable those accounts in Authentication Section.

Answer 4

Elaborating a bit on Doug's answer above, I've found something like this helpful:
Create a collection (assuming Firestore) called cms_users or similar where you will keep the users that should be able to access the application. I also store more granular permissions on the table.
Create a Firestore rule function that will get whether or not the requesting user appears in that table, e.g.
function getCMSUser() { return get(/databases/$(database)/documents/cms_users/$(request.auth.uid)); }
Create a rule that ensures that the collection is only readable by users that are in that collection:
match /phoenixcms_users/{userId} { allow read: if getCMSUser() != null; }
And now, for example, if you have data that you want to restrict read/writes to only those users, something like:
match /cms_secret_collection/{document=**} { allow read: if getCMSUser() != null; allow write: if getCMSUser() != null && getCMSUser().data.permissionLevel in ["owner", "admin"]; }
In the above example, you can see that all 'CMS' users can view the data, but only certain CMS users with owner or admin permission can write the data.