如何检查用户是否在Firebase Auth中被禁用 [英] How To Check Whether User is Disabled or Not in Firebase Auth

问题描述

我有一个使用Firebase Auth实现的登录系统，但是无论何时禁用任何用户，他/她仍然可以登录.

I have a Login System implemented using Firebase Auth, But Whenever I Disable any user he/she can still be logged.

但是当他/她注销并自己登录时，则禁用系统正在运行.

But When he/she log out and login him/her by themselves, then the disable system is working.

那么我该如何做才能每次检查用户是否被禁用? 有什么功能吗?

So what should I do to check every time, whether a user is disabled or not? Is there any function or something?

谢谢.

推荐答案

如果您disable或delete，则用户帐户并不意味着它也会触发auth state change.也不应这样做，因为用户仍在应用程序中进行了身份验证.您需要知道，Firebase Authentication最多会在一个小时内尝试为已被禁用或删除的特定用户刷新访问令牌.但是在这种情况下，刷新将失败，这时用户将变得未经身份验证.这是将触发auth状态更改事件的地方.

If you disable or delete a user account does not mean that it also fires an auth state change. Nor should it, because the user is still authenticated in application. You need to know that in at most an hour, Firebase Authentication will try to refresh the access token for that particular user that was disabled or deleted. But in this case that refresh will fail, at which point the user will become unauthenticated. This is the point in which the auth state change event will fire.

如果要立即撤销用户的授权，则必须在应用程序逻辑的另一部分中这样做.关于Firebase的一种常见做法是在数据库中创建一个名为blacklist的新节点，该节点应如下所示:

If you want to revoke the user's authorization immediately, you'll have to do so in another part of your application logic. A common practice when it comes to Firebase is to create a new node in your database called blacklist that should look like this:

Firebase-root
   |
   --- bannedUsers
          |
          uidOfBannedUser: true

现在，当您在Firebase控制台中删除/禁用用户帐户时，还需要将相应的uid添加到数据库中被禁止的用户列表中.

Now when you delete/disable a user's account in your Firebase console, you also need to add the corresponding uid to the list of banned users in the database.

然后，借助 Firebase数据库安全性，可以防止未经授权的用户访问数据库.规则.可以通过在数据库安全规则中添加如下子句来完成此操作:

The database can then be secured against access from unauthorized users with the help of Firebase Database Security Rules. This can be done by adding a clause to your database security rules like this:

{
  "rules": {
    "bannedUsers": {
      ".read": true,
      ".write": false // only admins can write these
    },
    "messages": {
      ".read": "auth != null && !root.child('bannedUsers').child(auth.uid).exists()"
    }
  }
}

如果您使用其他后端，则实现将有所不同.可以提供更多示例，但是像这样的黑名单是禁止用户使用的一种常见方法.您会发现，您甚至不必在乎它们的身份验证，只需禁用它们，而不必删除它们的凭据，而只需重新创建即可.

If you use a different back-end, the implementation will be different. There can orher more examples but a blacklist like this is a common approach to ban users. You'll find that you may even care little enough about their authentication that you only ban them, instead of deleting their credentials, which they could simply recreate.

这篇关于如何检查用户是否在Firebase Auth中被禁用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！