Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] Desktop Auth: LinkWithCredential (and Reload) never persist the updated user; user is restored as the pre-link anonymous user and signed out after restart

Aperta
  • Qualcosa non va?
#1,935 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cpp
Ambito
authentication

Direzione di ricerca

Start with auth/src/desktop/user_desktop.cc and auth/src/desktop/authentication_result.cc, following the link paths and persistence calls described in the issue. Check existing desktop Auth tests for link, reload, and persisted-user behavior, then run the relevant tests. Done means successful linking persists the updated user across restart, with regression coverage for the reported stale state.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

[REQUIRED] Please fill in the following fields:
  • Pre-built SDK from the website or open-source from this repo: Pre-built (firebase_cpp_sdk_windows_13.5.0.zip, downloaded by FlutterFire's firebase_core 4.10.0 Windows plugin; firebase_auth plugin 6.5.2). The relevant code is unchanged on current main (0fe9d97).
  • Firebase C++ SDK version: 13.5.0
  • Problematic Firebase Component: Auth
  • Other Firebase Components in use: App, Firestore (not involved)
  • Platform you are using the C++ SDK on: Windows
  • Platform you are targeting: desktop (Windows)
[REQUIRED] Please describe the issue here:

On desktop, linking a credential to the signed-in user (same uid) updates the in-memory user but never writes it to the persisted user data. After the next process start, the SDK restores the stale pre-link state: the user is still anonymous, has no linked provider, and has the old tokens. For an email/password link, the restored session is then rejected by the backend and the SDK signs the user out. So an anonymous user who upgrades their account by linking is signed out on the next launch. We see this in production on Windows.

Why it happens (current main, 0fe9d97a8e067418a607db17016948671a0b6fa7)

  1. UserDataPersist is registered only as an AuthStateListener and saves only from OnAuthStateChanged:

  2. AuthenticationResult::SetAsCurrentUser notifies auth-state listeners only when the uid changes. A link keeps the uid, so the persister is never called:

  3. The only other save path, TriggerSaveUserFlow, is called only from PerformSetAccountInfoFlow (UpdateUserProfile, UpdatePassword, UpdateEmail, ...) and from PerformReauthFlow:

  4. Neither link path calls it:

  5. User::Reload() (the callback comment says "No listeners will be notified") and token refresh in EnsureFreshToken don't save either:

So after an anonymous user links email/password, the persisted data still says is_anonymous = true, has no email/password provider, and holds the pre-link ID and refresh tokens. As far as we can observe, setting a password on the account invalidates the previously issued tokens on the backend. After a restart:

For an OAuth link, the restored user is reported as anonymous with no linked provider until something reloads it.

Steps to reproduce:

Have you been able to reproduce this issue with just the Firebase C++ quickstarts ?
Not with the quickstart. We hit it through the FlutterFire Windows plugin, which calls User::LinkWithCredential directly. The snippet below is the same sequence of calls in plain C++.

What's the issue repro rate? (eg 100%, 1/5 etc)
100% for the stale persisted state (it follows from the code paths above). The sign-out after an email/password link happens on every launch we have looked at.

What happened? How can we make the problem occur?

  1. SignInAnonymously(). The user is persisted (the uid changed, so the persister ran).
  2. current_user().LinkWithCredential(EmailAuthProvider::GetCredential(email, password)). This succeeds; in memory the user is no longer anonymous and has the password provider.
  3. Restart the process (or destroy Auth/App and create them again) and wait for the persisted user to load.
  4. current_user() has the same uid but is_anonymous() == true, an empty email() and no password in provider_data(). Reload() fails with kAuthErrorUserTokenExpired and the user is signed out.

Expected: a successful link (and arguably Reload() and a token refresh) persists the updated user, the same way sign-in, UpdateUserProfile and reauthentication do. After the restart the user is the linked, non-anonymous account and stays signed in.

Suggested fix: call TriggerSaveUserFlow(handle->auth_data) after a successful SetAsCurrentUser in PerformSignUpFlow (when used for linking) and in the verifyAssertion link lambda in DoLinkCredential. The same probably applies to Unlink, to Reload() after MergeToCurrentUser, and to EnsureFreshToken when has_token_changed. Another option is to have UserDataPersist also save on ID-token changes.

Workaround: after a successful link, call UpdateUserProfile with an unchanged display name. It goes through PerformSetAccountInfoFlow → TriggerSaveUserFlow and writes the current user to disk.

Relevant Code:
#include "firebase/app.h"
#include "firebase/auth.h"

using firebase::auth::Auth;
using firebase::auth::EmailAuthProvider;

// Run 1
firebase::App* app = firebase::App::Create(options);
Auth* auth = Auth::GetAuth(app);

auto anon = auth->SignInAnonymously();
// ... wait for completion; the anonymous user is persisted ...

auto link = auth->current_user().LinkWithCredential(
    EmailAuthProvider::GetCredential("[email protected]", "password123"));
// ... wait for completion: error() == kAuthErrorNone,
//     current_user().is_anonymous() == false, provider "password" present.
// Nothing is written to the persisted user data here.

// Run 2 (new process)
firebase::App* app2 = firebase::App::Create(options);
Auth* auth2 = Auth::GetAuth(app2);
// ... wait for the first AuthStateListener callback (persisted user loaded) ...
firebase::auth::User user = auth2->current_user();
// user.is_anonymous() == true, user.email() == "", no "password" provider
// (the pre-link state).

auto reload = user.Reload();
// ... wait: reload.error() == kAuthErrorUserTokenExpired,
//     and auth2->current_user().is_valid() == false (signed out).
Lingua principale
C++
Stelle
326
Fork
137
Merge medio
2g 5h
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di firebase/firebase-cpp-sdk

Tutte le issue di firebase/firebase-cpp-sdk

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.