How to disable Signup in Firebase 3.x

Question

I have created some users using firebase.auth().signInWithEmailAndPassword and would like to stop signUp now, but keep signIn working. I tried some rules on users and even to stop writing to firebase at all. However registration was still possible. Disabling Email/Password within console disables login too.

{
  "rules": {
        ".read": true,
        ".write": false,
      }
}

Any ideas how to apply security rules to users in Firebase 3?

Answer 1

Firebase explicitly separates authentication (signing in to the app) from authorization (accessing database or storage resources from the app).

You cannot disable sign-up without disabling sign-in for all users, which is not what you want.

In a typical scenario, developer will start securing database/file access based on the authenticated user. See the relevant section in the docs for database security and storage security.

If your use-case is that you only want specific users to have access, you'll probably want to implement a whitelist: a list of users that are allowed to access the data.

You can do that in your security rules:

{
  "rules": {
        ".read": "auth.uid == '123abc' || auth.uid == 'def456'",
        ".write": false,
      }
}

Or (better) by putting the list of allowed uids in your database and referring to that from your security rules:

"allowedUids": {
    "123abc": true,
    "def456": true
}

And then:

{
  "rules": {
        ".read": "root.child('allowedUids').child(auth.uid).exists()",
        ".write": false,
      }
}

Answer 2

Well it's been days since the question was asked but maybe this could help for those who are still wondering for answer, we still can't simply disable the new account creation but we can do using Firebase functions:

Here is the workaround for auto disable new users using cloud functions.

const admin = require("firebase-admin");

exports.blockSignup = functions.auth.user().onCreate(event => {
  return admin.auth().updateUser(event.uid, { disabled: true })
    .then(userRecord => console.log( "Auto blocked user", userRecord.toJSON() ))
    .catch(error => console.log( "Error auto blocking:", error ));
});

Remembering that this function is fired when you create users using the Firebase web console, or by 3rd parties. So you have to create, await the function, then enable the user.