Skip to content

feat(auth): improve invalid password guidance for OAuth accounts#1379

Open
kevinfernandes-hub wants to merge 2 commits into
firebase:mainfrom
kevinfernandes-hub:fix-invalid-password-provider-hint
Open

feat(auth): improve invalid password guidance for OAuth accounts#1379
kevinfernandes-hub wants to merge 2 commits into
firebase:mainfrom
kevinfernandes-hub:fix-invalid-password-provider-hint

Conversation

@kevinfernandes-hub

Copy link
Copy Markdown

Summary

Improves the error message shown when a user attempts Email + Password sign-in for an account that was originally created using another provider.

Previously, users would only see "Incorrect password", which could be confusing for accounts without a password.

This change replaces the message with:

Incorrect email or password. If you previously signed in using another provider, try using that sign-in method instead.

Motivation

Addresses issue #1313 by providing more helpful guidance while preserving existing authentication behavior and avoiding email enumeration concerns.

Changes

  • Updated handling for INVALID_PASSWORD / auth/wrong-password.
  • Improved the user-facing error message.
  • Added tests verifying the new behavior.

Closes #1313.

@google-cla

google-cla Bot commented Jun 23, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the wrongPassword error message to a more descriptive text advising users to try their previous sign-in method if they used another provider. This change is applied to the English (US and GB) locale files, type definitions, and various test suites. The review feedback suggests refactoring the tests to reference the enUs translation object directly rather than hardcoding the long error message string, which will improve test maintainability.

Comment thread packages/react/src/auth/oauth/oauth-button.test.tsx
Comment thread packages/react/src/auth/oauth/oauth-button.test.tsx
Comment thread packages/translations/src/mapping.test.ts
Comment thread packages/shadcn/src/components/oauth-button.test.tsx
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trying to log in with Email+Password when already logged in with OAuth previously only shows "Incorrect password"

1 participant