-
Notifications
You must be signed in to change notification settings - Fork 107
Authentication #368
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Authentication #368
Changes from 6 commits
b4fa662
90db42e
99e687a
b83d934
0f8de61
e0de58a
3b39ab8
bc7144b
db8f2fa
88fa1a6
ab82135
9415f2e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
{ | ||
"label": "Authentication" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
--- | ||
keywords: ['permission', 'permission_denied', 'code'] | ||
slug: /code-403-the-caller-does-not-have-permission-status-permission-denied | ||
title: 'Code: 403, The caller does not have permission. status: PERMISSION_DENIED' | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
--- | ||
# Code: 403, The caller does not have permission. status: PERMISSION_DENIED | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
This error typically occurs when your application or service account does not have the required permissions to access a resource in Google Cloud or Firebase. | ||
|
||
## What does this error mean? | ||
|
||
You may encounter this error due to one or more of the following reasons: | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
- **Invalid or misconfigured service account JSON file** | ||
- **Insufficient permissions** assigned to the service account | ||
- **Missing or incorrect IAM roles** for the service account | ||
- **API not enabled** in the Google Cloud project | ||
|
||
## Example Full Error Message | ||
|
||
``` | ||
Code: 403, The caller does not have permission. status: PERMISSION_DENIED | ||
``` | ||
|
||
## How to Fix | ||
|
||
1. **Check your service account JSON file** | ||
- Ensure you are using the correct file and it is not corrupted. | ||
2. **Verify IAM roles and permissions** | ||
- Make sure the service account has the necessary roles (e.g., Editor, Owner, or specific roles required for your use case). | ||
3. **Enable required APIs** | ||
- Go to the [Google Cloud Console](https://console.cloud.google.com/apis/library) and ensure all necessary APIs are enabled for your project. | ||
4. **Regenerate service account keys if needed** | ||
- If you suspect the key is invalid, generate a new one and update your application configuration. | ||
|
||
:::tip[Pro Tip: Always Use Least Privilege Principle] | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
When assigning IAM roles to your service account, follow the **principle of least privilege**—only grant the minimum permissions necessary for the task. This not only reduces the risk of misconfiguration but also enhances the overall security posture of your app. | ||
::: | ||
|
||
If you continue to experience issues, consult the [Google Cloud IAM documentation](https://cloud.google.com/iam/docs/troubleshooting-access) or contact support for further assistance. |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,79 @@ | ||
--- | ||
keywords: ['authentication', 'api', 'configuration'] | ||
slug: /custom-authentication-in-flutterflow | ||
title: Custom Authentication in FlutterFlow | ||
--- | ||
# Custom Authentication in FlutterFlow | ||
|
||
**Pre-Requisites to Enabling Custom Authentication:** | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
Ensure you have a **custom server** with login and sign-up endpoints that return a JWT token upon success | ||
|
||
**Custom authentication** must be enabled in FlutterFlow, with entry and logged-in pages correctly set | ||
|
||
Here's an example: | ||
|
||
 | ||
|
||
**Checklist for Troubleshooting** | ||
|
||
**Verify Server and API Endpoints** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. checklists should be in bullet points |
||
|
||
Confirm that your server is correctly returning JWT tokens for login and sign-up requests. The server's response should include the authentication token, refresh token, expiration time, and user ID (UID). | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. bullets are missing from this doc completely, please revisit this file and add bullets or numbering wherever necessary. |
||
|
||
Double-check the API endpoint configurations in FlutterFlow to match your server's requirements. | ||
|
||
**FlutterFlow Configuration** | ||
|
||
Make sure custom authentication is enabled in the project settings. | ||
|
||
Verify that the entry point and logged-in pages are set correctly. | ||
|
||
**UI Configuration** | ||
|
||
To facilitate the authentication flow, ensure your app has at least three pages: | ||
|
||
Login | ||
|
||
Sign Up | ||
|
||
Home Page (i.e. the landing page when a user successfully authenticates) | ||
|
||
**API Integration and Authentication Flow** | ||
|
||
Test API calls from FlutterFlow to your server and ensure responses are received as expected. | ||
|
||
Upon successful authentication, use the backend FlutterFlow action to call the API. Then, utilize the response data to perform a "custom login" action within FlutterFlow. | ||
|
||
**Handling Tokens and User Data** | ||
|
||
Set up your FlutterFlow actions to correctly parse the API response, capturing the auth token, refresh token, expiration time, and user ID (UID). This data is crucial for managing user sessions. | ||
|
||
 | ||
**Navigation** | ||
|
||
If automatic navigation after login or sign-up is not working, you can disable it. | ||
|
||
Then, opt for manual navigation to ensure users are directed to the correct page after authentication. | ||
|
||
**General Tips** | ||
|
||
Utilize logging both on your server and within FlutterFlow (snack bars, alerts) actions to track the authentication flow and identify any points of failure. | ||
|
||
Test the entire authentication flow, from entering credentials to accessing protected pages after login, to ensure there are no breaks in the process. | ||
|
||
By carefully following this guide, you should be able to troubleshoot and resolve common issues encountered when setting up custom authentication in FlutterFlow. | ||
|
||
:::tip[Pro Tip: Use Test Credentials First] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. same comment about removing pro tip, please remove it from everywhere. |
||
Before integrating real user data, test your custom authentication flow using **dummy credentials** on your server. This allows you to debug token handling, API responses, and navigation logic safely—without risking user experience or exposing sensitive data. | ||
::: | ||
|
||
|
||
**More resources:** | ||
|
||
https://www.youtube.com/watch?v=hnX3CvBtGvI | ||
|
||
**Sample project:** https://app.flutterflow.io/project/custom-auth-checklist-fdjkno | ||
|
||
https://docs.flutterflow.io/data-and-backend/custom-authentication | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
--- | ||
keywords: ['properly', 'delete', 'working'] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. the keywords dont make sense here, can we add proper keywords that is related to the topic? |
||
slug: /delete-user-action-is-not-working-properly | ||
title: Delete user action is not working properly | ||
--- | ||
# Delete user action is not working properly! | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. no exclamation in title |
||
|
||
 | ||
|
||
When a user attempts to delete their account, they may find that the delete action doesn't work as expected. Here are some tips for troubleshooting this issue: | ||
|
||
Understand that the delete action in Firebase is designed to delete the user from the auth table only. This means that the user's document in the database will not be affected. If you want to delete the user's document from the database as well, you'll need to create a custom action with some custom code. | ||
|
||
After you've completed the delete action, it's important to log out the user. This is because there is no longer a user connected to the authenticated user in the app. Logging out will ensure that the user is routed back to the login page, which is the initial page of your project. | ||
|
||
:::tip[Pro Tip: Delete Related Data Before Deleting the User] | ||
Before calling the delete user action, make sure to first delete any related data (e.g., Firestore documents, Storage files) associated with the user. Once the user is deleted from Firebase Auth, their UID will no longer be accessible in the app session, making it difficult to reference their data afterward. | ||
::: | ||
|
||
|
||
Keep in mind that if the same user uses the same signup method to log in again, Firebase will create a new document in the database for them. This is because Firebase will connect the new login information to the old user document. | ||
|
||
Note: the action we do in Flutterflow is exactly the same action we can do manually to delete a user from the authentication table in Firebase. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. please use admonitions for notes, check guidelines |
||
|
||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
--- | ||
keywords: ['firebase', 'deployment', 'android'] | ||
slug: /google-sign-in-troubleshooting | ||
title: Google Sign-In Troubleshooting | ||
--- | ||
# Google Sign-In Troubleshooting | ||
|
||
If you face any issues while using the Google Sign-in feature from the exported app, then follow the given instructions to resolve them: | ||
|
||
**If App is Pushed to Play Store from FlutterFlow by using CodeMagic deployment:** | ||
|
||
Deploy the application to Google Play Store by using the CodeMagic Integration in FlutterFlow. | ||
 | ||
|
||
After this step, head over to the **Google Play Console**. Here open the app from the **All apps** list. | ||
 | ||
|
||
After opening the app dashboard, click on the **App Integrity **option under the **Setup** menu present on the left side of the screen**.** | ||
 | ||
|
||
After opening the **App Integrity **section, click on the **App Signing **tab. Here you'll find the** SHA-1 certificate fingerprint. **Copy this key by clicking on the **Copy** Icon. | ||
 | ||
|
||
After completing the above steps, head over to the **Firebase console** and open the project settings of the same project. | ||
|
||
 | ||
|
||
Here, scroll down to the find **Your Apps **section. Select the **Android app** and click on **Add fingerprint. **You'll need to paste the copied SHA-1 Fingerprint here and then hit **Save.** | ||
 | ||
|
||
After this, you'll need to Regenerate the config files from FlutterFlow. To do this, open your app in **FlutterFlow** and then click on **Settings** **>** **Firebase**. | ||
 | ||
|
||
Here, Click on the **Regenerate Config Files **button and then Click on **Generate Files.** | ||
 | ||
|
||
This issue should now be resolved. You can now re-test to confirm that the issue has been fixed. | ||
**If you have not yet pushed to the play store or are self-signing your app** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. why is this in bold? |
||
If you're not using Play Store App Signing or have not deployed yet, follow the instructions in our documentation to use Keytool or Gradle's Signing Report to get your SHA-1. | ||
|
||
After manually generating the SHA-1 please make sure to update it in Firebase and then regenerate the config files in FlutterFlow using these instructions: | ||
|
||
Head over to the **Firebase console** and open the project settings of your project. | ||
|
||
 | ||
|
||
Here, scroll down to the find **Your Apps **section. Select the **Android app** and click on **Add fingerprint. **You'll need to paste the copied SHA-1 Fingerprint here and then hit **Save.** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. grammar is incorrect in the first sentence |
||
 | ||
|
||
After this, you'll need to Regenerate the config files from FlutterFlow. To do this, open your app in **FlutterFlow** and then click on **Settings** **>** **Firebase**. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There are certain words that are capitalized here in the middle of the sentence (and its not a button name) which doesnt make sense to me, like Click and Regenerate. please correct |
||
 | ||
|
||
Here, Click on the **Regenerate Config Files **button and then Click on **Generate Files.** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. faulty bold placement, please run the file and check this section. the bold doesnt in Regenerate part doesnt work. |
||
 | ||
* * | ||
This issue should now be resolved. You can now re-test to confirm that the issue has been fixed. | ||
|
||
*You can also refer to the **Google Play Services** documentation for more information.* | ||
|
||
:::tip[Pro Tip] | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
If you're testing Google Sign-In inside FlutterFlow or using the app before deploying to the Play Store, make sure to **add your debug SHA-1 fingerprint** to Firebase. Without this, authentication won't work during development. | ||
|
||
After adding it, don't forget to **regenerate your Firebase config files in FlutterFlow** under `Settings → Firebase → Regenerate Config Files → Generate Files`. | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
::: |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
--- | ||
keywords: ['firebase', 'auth', 'authenticated'] | ||
slug: /how-to-retrieve-the-authenticated-type-from-firebase-auth-in-flutterflow | ||
title: How to retrieve the authenticated type from Firebase auth in Flutterflow | ||
--- | ||
# How to retrieve the authenticated type from Firebase auth in Flutterflow | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
Understanding which authentication method a user has used can be useful for several reasons. For example, it can be leveraged for analytics, user support, and to customize the user's experience based on their login method. This method, however, is specific to Firebase Authentication. | ||
|
||
In our Flutter app, we can find out which method a user used to authenticate by leveraging Firebase's User.providerData property. Let's take a closer look at how this works in the code: | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. add code span to User.providerData like |
||
|
||
``` | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
import 'package:firebase_auth/firebase_auth.dart';String getUserSignInMethod() { final user = FirebaseAuth.instance.currentUser; String signInMethod; for (var info in user.providerData) { signInMethod = info.providerId; } return signInMethod;} | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. code is not formatted properly. |
||
``` | ||
|
||
Here's a breakdown of the code: | ||
|
||
We first import the FirebaseAuth package which gives us access to Firebase's authentication methods. | ||
|
||
Next, we define a function **`getUserSignInMethod`**. This function will return a string indicating the sign-in method the user used. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We dont do bold for code spans, please remove from everywhere. |
||
|
||
Inside the function, we obtain the current user from FirebaseAuth using **`FirebaseAuth.instance.currentUser`**. | ||
|
||
We then declare a string **`signInMethod`** that will store the name of the provider used for sign-in. | ||
|
||
**`user.providerData`** is an iterable that provides UserInfo for each sign-in method used by the user. We loop over this iterable using a **`for`** loop. | ||
|
||
In each iteration, we assign the **`providerId`** to our **`signInMethod`** string. The **`providerId`** can be 'google.com' for Google, 'facebook.com' for Facebook, and 'password' for email and password. | ||
|
||
After the loop is done, the function returns **`signInMethod`** string which indicates the sign-in method the user used. | ||
|
||
The function **`getUserSignInMethod()`** returns a String value which corresponds to the providerId of the user's sign-in method. | ||
Here are examples of how the return value might look: | ||
|
||
If the user has signed in using Google, the function will return: **`'google.com'`** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The next 3 lines can be in bullets There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is incomplete |
||
|
||
If the user has signed in using Facebook, the function will return: **`'facebook.com'`** | ||
|
||
If the user has signed in using Email and Password, the function will return: **`'password'`** | ||
|
||
These are the identifiers used by Firebase to represent different sign-in methods.Please, thoroughly test this function to ensure it fits your specific requirements. | ||
|
||
:::tip[Pro Tip] | ||
In FlutterFlow, if you want to display or use the user's sign-in method in your UI logic (e.g., showing different UIs for Google vs. email login), you can create a custom function using the `providerId` approach shown in the article and **connect it to a custom action**. This allows you to make dynamic decisions inside your app based on how the user authenticated. | ||
|
||
Remember to return the result from the custom function and store it in an App State variable for easy access throughout your app. | ||
::: | ||
|
||
For more details, you can refer to Firebase's official documentation, as well as our **documentation**, **community tutorials**, **Youtube channel**, **blog**, and **intercom articles**. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove this line or provide links to all said items |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
--- | ||
keywords: ['homepage', 'mode', 'after'] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. "after" cant be a keyword. |
||
slug: /my-app-is-starting-from-homepage-after-logging-in-once-in-the-run-mode | ||
title: My app is starting from HomePage after logging in once in the Run Mode | ||
--- | ||
# My app is starting from HomePage after logging in once in the Run Mode | ||
|
||
If your app always starts from the HomePage after logging in once (especially in Run Mode), this is likely due to cached authentication or session data in your browser. | ||
|
||
## Troubleshooting Steps | ||
|
||
- **Clear your browser cache and history.** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. why is this whole line in bold? seems redundant |
||
|
||
 | ||
|
||
- **Try a different browser** or use **incognito/private browsing mode** to see if the issue persists. | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
If the problem continues, consider checking your authentication flow and session management in your app settings. | ||
|
||
:::tip[Pro Tip] | ||
When testing in Run Mode, **FlutterFlow retains your authentication state across sessions** unless explicitly reset. To simulate a real first-time user experience, consider adding a **"Log Out" button** on your HomePage that calls the `Sign Out` action. This ensures that the next time you run the app, it starts from the login screen rather than using stored session data. | ||
::: | ||
|
||
|
||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
--- | ||
keywords: ['android', 'signing', 'release'] | ||
slug: /safetynet-phone-sign-in-issue-on-android-devices | ||
title: SafetyNet phone sign-in issue on android devices | ||
--- | ||
# SafetyNet phone sign-in issue on android devices | ||
|
||
It looks like you are experiencing an issue with using the Firebase Phone Authentication method. To troubleshoot this issue, there are a few things you can try: | ||
|
||
Make sure you have correctly configured the Firebase Phone Authentication method in your app. This includes setting up a project in the Firebase console and adding the necessary dependencies to your app. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. These need to be in bullets |
||
|
||
Check that you have properly implemented the phone authentication flow in your app. This includes prompting the user to enter their phone number, sending a verification code to the user's phone, and verifying the code that the user enters. | ||
|
||
Make sure that you have correctly configured the safety net and reCAPTCHA checks in your app. This may involve adding the necessary dependencies and configuring the keys in your app. | ||
|
||
If you are using an emulator to test your app, try testing on a physical device instead. Emulators may not always behave the same as physical devices, and this could be causing the issue you are experiencing. | ||
|
||
If you are still experiencing issues, try reviewing the documentation and tutorials provided by Firebase to ensure that you have correctly implemented the phone authentication flow in your app. | ||
|
||
Solution: Read more information here | ||
 | ||
To use phone number authentication, Firebase must be able to verify that phone number sign-in requests are coming from your app. There are two ways Firebase Authentication accomplishes this: | ||
**1- SafetyNet**:If a user has a device with Google Play Services installed, and Firebase Authentication can verify the device as legitimate with Android SafetyNet, phone number sign-in can proceed. | ||
To enable SafetyNet for use with Firebase Authentication: | ||
|
||
In the Google Cloud Console, enable the Android Device Verification (DEPRECATED) API for your project. The default Firebase API Key will be used, and needs to be allowed to access the DeviceCheck API. | ||
|
||
If you haven't yet specified your app's SHA-256 fingerprint, do so from the Settings Page of the Firebase console. Refer to Authenticating Your Client for details on how to get your app's SHA-256 fingerprint. | ||
|
||
The SafetyNet Attestation API is deprecated and has been replaced by the Play Integrity API. We are working on a migration path to the Play Integrity API, which we expect to make available within the SafetyNet deprecation timeline. After 31 January 2023, you will not be able to enable the Android Device Verification (SafetyNet) API in the Google Cloud Console. To enable the Android Device Verification (SafetyNet) API in a new project after Jan 31, 2023, submit the SafetyNet Attestation API Onboarding form. | ||
SafetyNet has a default quota that is sufficient for most apps. See SafetyNet Quota Monitoring for more information. | ||
2- **reCAPTCHA verification**:In the event that SafetyNet cannot be used, such as when the user does not have Google Play Services support, or when testing your app on an emulator, Firebase Authentication uses a reCAPTCHA verification to complete the phone sign-in flow. The reCAPTCHA challenge can often be completed without the user having to solve anything. Please note that this flow requires that a SHA-1 is associated with your application. This flow also requires your API Key to be unrestricted or allow listed for "your-project-name.firebaseapp.com". | ||
The reCAPTCHA flow will only be triggered when SafetyNet is unavailable or your device does not pass suspicion checks. Nonetheless, you should ensure that both scenarios are working correctly. | ||
|
||
Next: | ||
**Release mode**If you're releasing your app to the Play Store, you must add the SHA certificate fingerprints from the Play Console To get the keys for the release app, navigate to **Play Store Console > Your project > Release Management –> App Signing** and copy the **SHA-1** and **SHA-256** keys. | ||
mrdavidorok marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
|
||
|
||
 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Assets are in the wrong place. It should be in docs/troubleshooting and not docs.