How to allow only specific email domains in Firebase?

 

Step 1: Set Up Firebase Project

 

• Go to the Firebase Console.
• Click on Add project and follow the prompts to create a new project.
• Choose your Google Analytics preferences.

 

Step 2: Set Up Firebase Authentication

 

• Navigate to Build > Authentication in the Firebase Console.
• Click on Get Started.
• In the Sign-in Method tab, enable the Email/Password provider.

 

Step 3: Write Firebase Cloud Function

 

• Open your terminal or command line interface.

• Ensure you have the Firebase CLI installed. If not, install it using:

  npm install -g firebase-tools
  

• Log in using your Google account:

  firebase login
  

• Navigate to your Firebase project directory and initialize Cloud Functions:

  firebase init functions
  

• Follow the prompts to set up your Cloud Functions environment.

• Choose JavaScript or TypeScript for your language preference.

 

Step 4: Add Domain Whitelisting Logic

 

• Open the generated index.js file in your functions directory.
• Add the following code to listen for new user sign-ups and allow only specific domains:

  const functions = require('firebase-functions');
  const admin = require('firebase-admin');

admin.initializeApp();

exports.allowSpecificDomains = functions.auth.user().onCreate((user) => {
const allowedDomains = ['example.com', 'anotherexample.com'];
const email = user.email || '';
const emailDomain = email.split('@')[1];

if (!allowedDomains.includes(emailDomain)) {
return admin.auth().deleteUser(user.uid)
.then(() => {
console.log(Deleted user with disallowed domain: ${email});
})
.catch((error) => {
console.error('Error deleting user:', error);
});
}
return null;
});


• Save the file.

 

Step 5: Deploy the Cloud Function

 

• Deploy your function to Firebase using the command:

  firebase deploy --only functions
  

• Wait for the deployment to complete successfully.

 

Step 6: Test the Domain Restriction

 

• Try signing up with allowed and disallowed email domains.

• Check the Firebase Authentication panel to ensure users with disallowed domains are deleted.

• Monitor the Logs in Firebase Functions to review actions taken on sign-up:

• Navigate to Functions in the Firebase Console.

• Click Logs to see the triggering logs of your Cloud Function.

 

Step 7: Secure Your Implementation

 

• Regularly update your whitelist of domains as needed.
• Consider adding detailed logging for auditing purposes.
• Implement additional security and error handling in your functions for production readiness.