Expiry date on verification email with Firebase

4
votes

I'm building a Firebase app and just implemented the email verification process. However, I was thinking that it could be a problem if the verification email would not expire. This way, users can just register with a random email address and not verify it, which means the real person with that email address cannot register anymore ( firebase.auth().createUserWithEmailAndPassword will just create this user in the Authentication tab, and that email address cannot be used anymore ). Is there a way to let the verification email expire? So for example, if the user does not verify his address within 24 hours, the email address becomes available again (or something similar).

Thanks!

1
firebasefirebase-authentication
I can confirm that Firebase Auth verification emails expire. I think it is currently 3 days but is subject to change (controlled by the Firebase Auth backend). You can always use the admin SDK to delete a user that is not verified after a while via some cron job as camden_kid mentioned. – bojeil

1 Answers

5
votes

From experience, the email verification does expire, but I can't give you an exact time period for the expiration.

As far as I am aware, the registration does not get deleted if the email is not verified.

I had a similar concern to yours and so I created a cron job to delete registrations if the user does not use my app within 24 hours. You could do something similar for someone who hasn't confirmed their email within 24 hours.

I create an entry in the database for new registrations and the cron job checks the timestamp of the entry and deletes the registration if the time is greater than 24 hours. The entry is deleted if the user uses the app within 24 hours.