firebase.auth().confirmPasswordReset() is throwing the wrong error

[REQUIRED] Describe your environment

  • Operating System version: Windows 10
  • Browser version: Firefox 65.0
  • Firebase SDK version: 5.8.2
  • Firebase Product: auth

[REQUIRED] Describe the problem

firebase.auth().confirmPasswordReset() is throwing the wrong error. Instead of auth/user-disabled, it throws auth/invalid-action-code.

Steps to reproduce:

  1. Create an email-password user.
  2. Disable user.
  3. Send password reset email to user.
  4. Run the following code:
const actionCode = "abc"; // Replace this with the action code from the email
const newPassword = "qwerty123"; // New password for user

firebase.auth().confirmPasswordReset(actionCode, newPassword).then(() => {
  // Reset was successful
  console.log("Success");

}).catch(error => { console.error(error) });

In Firefox 65, this error is thown:

{ code: "auth/invalid-action-code", message: "The action code is invalid. This can happen if the code is malformed, expired, or has already been used.", stack: "" }

instead of this more relevant error that is thrown in Chrome 72.0.3626.96:

{ code: "auth/user-disabled", message: "The user account has been disabled by an administrator." }

The latter error is more relevant because the action code is valid, current, and unused, the problem is that the user is disabled and it would be nice if this was reflected in the error message.

Also, it it’s helpful, both firebase.auth().verifyPasswordResetCode() and firebase.auth().checkActionCode() work fine in both browsers.

1 possible answer(s) on “firebase.auth().confirmPasswordReset() is throwing the wrong error