Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Concurrent calls to auth.createUser() may create multiple user accounts with the same email address

Aperta
  • Qualcosa non va?
#2,949 0 commenti 7 reazioni 2 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

@Xiaoshouzi-gh ci sta già lavorando.

Dal 15/7/2025.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

api: auth
[REQUIRED] Step 2: Describe your environment
  • Operating System version: macOS 14.6.1 (23G93)
  • Firebase SDK version: [email protected]
  • Firebase Product: auth
  • Node.js version: 20.18
  • NPM version: 10.8.2
[REQUIRED] Step 3: Describe the problem

Firebase does not guarantee user email uniqueness in users in case duplicate & concurrent calls are made to auth.createUser(), despite the "User account linking" setting in the Console being set to "Link accounts that use the same email". The API is not idempotent.

This issue breaks the promise found in the following support documentation:

Users can never create multiple accounts with the same email address and sign-in method.

If calls to auth.createUser with the same email are separated enough in time (some tens of milliseconds?), the last call will raise a auth/email-already-exists error, which is the expected behavior.

Steps to reproduce:
  1. Run this Firebase Admin JS script against a production Firebase environment, using node v20
// `auth` is a Firebase Admin auth instance
import { auth } from "../src/admin.js";

const c = () =>
    auth.createUser({
        email: "[email protected]",
        displayName: "Test",
    });

await Promise.all([c(), c()]);

  1. Observe that two users were created with the same details, with different UIDs

    Screenshot of the Firebase Console Auth dashboard
Workaround

Avoid concurrent calls to auth.createUser() with the same email address.

We were likely getting this issue because our front-end registration form would be submitted two times if double-clicked, which in turn lead to two concurrent auth.createUser calls in the back-end. Now we've debounced this call, which should avoid the issue in most circumstances.

More context
  • We are not using "Firebase Auth with Identity Platform"
  • I believe this is exactly the same issue as the following issue reported for the Python Admin SDK https://github.com/firebase/firebase-admin-python/issues/809
  • We saw an increase in the frequency of this issue since we started using the Firebase Admin SDK for Firebase Auth account creation (5 cases over 2 months). In the years before, when we were still using front-end Firebase JS clients for Firebase Auth account creation, we only had 1 similar case. I assume the frontend client implements some kind of debouncing internally already?
Lingua principale
TypeScript
Stelle
1.8k
Fork
420
Merge medio
5g 6h
PR unite (30g)
11

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di firebase/firebase-admin-node

Tutte le issue di firebase/firebase-admin-node

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.