Do Not Require "Sign In With Google" to sign in with email (screenshots)

Facebook and Facebook Messenger’s In-App browser do not support Google’s OAuth. It throws an error on Google’s end during the redirect saying it doesn’t support that app. disallowed_useragent (iOS Only - works fine on android).

For this reason, when I detect the Facebook in-app browser, I force my users to login with email / password. (I do not include the Google login when Firebaseui initializes)

This works great for new users, they can create / sign in with email and password fine.

The problem is when users have previously created an account with their Google login, and then try to login through the Facebook in-app browser on iOS. They can try using the email / password authentication method, but then, Firebaseui tries to force this user to “sign in with google”, which subsequently throws the disallowed_useragent error.

How can you prevent this from happening, and merge the email / password auth account with the google account? If you create an account with email / password first, and then use Google to login, it works fine. Why not also work the other way around?

        // FirebaseUI config.
        var firebaseui = require('firebaseui');

        // Facebook browser does not support Google Auth
        // Check for Facebook browser
        let browser = null;
        if(typeof navigator !== "undefined" && typeof window !== "undefined") {
            var ua = navigator.userAgent || navigator.vendor || window.opera;
            if ((ua.indexOf("FBAN") > -1) || (ua.indexOf("FBAV") > -1)) {
                browser = "facebook";
            }
        }

        // Conditionally build signInOptions
        let signInOptions = [];

        // Add Email / Password Auth
        signInOptions.push(firebaseAuth.EmailAuthProvider.PROVIDER_ID);

        // Add Google Auth only if not Facebook browser
        if(browser !== "facebook") {
            signInOptions.push({
                // Google provider must be enabled in Firebase Console to support one-tap sign-up.
                provider: firebaseAuth.GoogleAuthProvider.PROVIDER_ID,
                // Required to enable this provider in one-tap sign-up.
                authMethod: 'https://accounts.google.com',
                // Required to enable ID token credentials for this provider.
                // This can be obtained from the Credentials page of the Google APIs
                // console.
                clientId: 'XXX'
            })
        }

        var uiConfig = {
            signInOptions,
            callbacks: {
                signInSuccessWithAuthResult: function(authResult, redirectUrl) {
                    // Anything we want to happen after signin success
                    
                    // Store user data in the redux store
                    storeUserDataAction(authResult.user);

                    // Auto-send verification email if we have not already done so
                    autoVerifyEmailAction();
                    
                }
            },
            // Terms of service url.
            tosUrl: 'XXX',
            // Required to enable one-tap sign-up credential helper.
            credentialHelper: firebaseui.auth.CredentialHelper.GOOGLE_YOLO
        };

        // Initialize the FirebaseUI Widget using Firebase.
        // Checks to see if we have an existing instance, if not, creates a new one
        var ui = firebaseui.auth.AuthUI.getInstance();
        if (!ui) {
            ui = new firebaseui.auth.AuthUI(firebaseAuth());
        }

        // Auto sign-in for returning users is enabled by default except when prompt is
        // not 'none' in the Google provider custom parameters. To manually disable:
        ui.disableAutoSignIn();

        // The start method only if we're done checking the authState
        ui.start('#fbui-container', uiConfig);
    }

[joshualyon]

I appreciate your reiteration.

What I’m saying is I don’t see how step 1 is adding any security in this specific case. In step 2, the account is automatically relinked. So what was the point of automatically unlinking it if it can just be automatically relinked?

[bojeil-google]

This is all expected behavior. There are 2 issues here that are unrelated:

1. password reset unlinks existing providers as @wti806 explained to help users recover from possible account modification (unauthorized providers being linked).
2. Google sign in overwriting unverified email/password account. Check this post why this happens. This prevents malicious users from creating an account with another user’s email. To avoid this behavior, you need to verify the user’s email after the account is created to confirm ownership of that email so the next time Google is used to sign in, the email/password is preserved.