In Cognito, how can I rollback my old email after the request of changing a new wrong email - email

I am using Cognito in my service and I want to enable my service to change email address.
In my frontend, I added code like this.
const email = 'foo#example.com'; // input
const user = await Auth.currentAuthenticatedUser();
await Auth.updateUserAttributes(user, { email });
I found this updateUserAttributes not only send verification email, but also change email address and set Email verified false before verification success.
When a user send wrong email address, I think, the user will no longer login, because the user cannot access to verification code and login old email.
Is there functions like rollback old email address in Cognito?

After some digging, I found the related issue
I found this updateUserAttributes not only send verification email, but also change email address and set Email verified false before verification success.
Unfortunately, this is Cognito side problem, and now there is no way to solve it fundamentally.
In the issue, Can-Sahin approach may help you.

Related

After I successfully register in app I didn't receive email verification link

Who encounter this problem? No error showed in log.
Last tym when I register and fill up the form and it was success and I received email verification, so I can enter to my app, and this month when I register to the the same registration activity, it was success but I didn't receive any emails verification.. how is this possible I didn't change it. And I didn't change in the firebase also.
Why? I try and try but . Nothing happen it never send me an email verification how many times I'd try so please help me.. I'm using Android studio java.
There could be a few reasons why you are not receiving email verification after registering in your app:
1.Check your email spam folder: Sometimes, email verification emails can end up in your spam folder, so make sure to check that.
2.Check if the email address is correct: Make sure that you are entering the correct email address when you register.
3.Check if the email verification is enabled in Firebase Console: Go to the Firebase Console and check if email verification is enabled for your project.
4.Check if the email verification template is correctly configured: Make sure that the email verification template is correctly configured in Firebase Console.
5.Check if your email service provider is blocking the verification email: Some email service providers may block verification emails, so you can try using a different email address to test if this is the issue.

Should I verify email addresses of Google Sign In users?

I am implementing an email verification service, with the purpose of confirming that the person registering is indeed the owner of that email address (specifically, that they work at the organisation that the email domain belongs to).
I will send an email post-registration with a single-use link in it that will set their status to verified = 1.
Users can choose to register and log-in using either a simple email/password combination, or by using the Google Sign In service.
My question is: do I need to verify the ones that have registered with Google Sign In? In order to provide their email address to me, they had to sign in with Google, who then confirmed the address. Is there anything I've missed here, or can I immediately consider these users to be the verified owners of these addresses?
If you are using google sign in there is no need to verify the user.
Whereas if have your own login system, then you must verify the email because
if the email is not verified then you cannot have forgotten password feature through email
and also the user might not have actually had the email so anyone else could create the same email and if you have forgotten password through email someone else could easily access others data.

Firebase email verification at SignUp

How should I go about verifying an email address prior to the user signing up with Firebase?
I know that an email address is verified with .sendEmailVerification, however this only works on the current user. Hence a user must be already created before sending a verification email. This would not be of much help since you obviously have to verify an email before adding it to your database. Therefore, what is a good workaround?
You can't verify the email prior to sign up with Firebase Auth. Email verification is not always required. This is why Firebase Auth provides it as a method on the user. Some applications do not require email verification on sign-up, others may make it optional, others may offer limited access to unverified users, etc.
If you want to require users to be verified before accessing your app content, you can either:
enforce that via Firebase rules, eg:
".read": "auth.token.email_verified === true"
Or, if you are using your own backend, use the Firebase Admin SDK,
https://firebase.google.com/docs/auth/admin/verify-id-tokens:
admin.auth().verifyIdToken(idToken).then(decodedToken => {
if (decodedToken.email_verified) {
// Email verified. Grant access.
} else {
// Email not verified. Ask user to verify email.
}
});

Facebook Email field return null (even if the “email” permission is set and accepted)

For some users in our application, the email field returns NULL even if the user has granted the email access to the app.
When we check the scope parameter and the validity of the user Token thanks to the Debugger tool, everything is ok. The permission email has been accepted.
But when we ask the Graph API for the email of the user with the valid user token, it does not appear at all.
Is there a way a user could prevent an app from getting his email even if he granted the email permission?
Thanks
I had the same problem and I think I found out why:
If the user has an unconfirmed email in Facebook (i.e. Facebook sent him a validation mail to the user's email address but he didn't respond) Facebook WILL NOT pass that email to your app even if he gave you the email permissions.
So what I did is use his or her Facebook email if the user has a user name (i.e. userName#facebook.com).
I have the same issue. It is working fine on my localhost, i am using php SDK for facebook login and when i submit my request it's return all the fields like email,name etc of the user but on server somehow it is not working.It will not returns user email.
I have done lots of R&D on that and i have the solution for the issue. :)
$profile = $facebook->api('/me?fields=email,first_name,last_name');
if you are using php-sdk just passes fields like this it returns the email,first_name etc.
Hopes it works for you all.
thanks.
All you need to know:
1) Link 1
Some possible reasons:
No Email address on account
No confirmed email address on account
No verified email address on account
User entered a security checkpoint which required them to reconfirm their email address and they have not yet done so
Users's email address is unreachable
You also need the 'email' extended permission, even for users who have
a valid, confirmed, reachable email address on file.
2) Link 2
Note, even if you request the email permission it is not guaranteed
you will get an email address. For example, if someone signed up for
Facebook with a phone number instead of an email address, the email
field may be empty.
Facebook does not send the email if the user has logged in with their phone number.
View the comments on https://github.com/mkdynamic/omniauth-facebook/issues/61 for more info.
You must give email permission along with the auth button.
authButton.setReadPermissions(Arrays.asList("email"));
In some cases Facebook may not have a valid email address for a user:
email: string containing a valid RFC822 email address - note: this
field may be null if no email address is available for the user
see https://developers.facebook.com/docs/reference/api/user/
#ozba solution is not applicable because facebook now shows an alert message when user has an unconfirmed email address. So, if you're having this problem it's more liking that the user had signed up using phone number.
Some possible reasons:
No Email address on account (only phone number)
No confirmed email address on account
User entered a security checkpoint which required them to reconfirm their email address and they have not yet done so users's email address is unreachable.
Check: https://developers.facebook.com/bugs/298946933534016
According to the documentation:
Note, even if you request the email permission it is not guaranteed you will get an email address. For example, if someone signed up for Facebook with a phone number instead of an email address, the email field may be empty.
That would explain why some users have a null email!
Facebook will provide you a user's email id if and only that user has a confirmed email id associated with his account. If your app can retrieve email id for some users, problem may not with the Developer.
I have read previous responses but though some of them true like if the user has not email confirmed but a mobile phone number, many times this error happens for ignoring how to request the information using FB api graph. Let's say your login was successfully done, and you now have an access token and user id an so on but still, cannot see email and other fields you are interested in. Go ahead using this request after confirming login status as connected:
FB.api(
'/me',
'GET',
{"fields":"id,name,birthday,email,about,cover"},
function(response) {
// Insert your code here
}
);
depends on permissions you requested you now will be able to catch further information according to your needs.
you can try this it will work
String email = user.getProperty("email").toString();
String safeEmail = user.asMap().get("email").toString();
You need one more permission from facebook.
include (about_me) permission to the facebook dev setting and also in your app or code..
Just you need to add more permissions to whatever data you want from Facebook object about your user.
Facebook API
$loginUrl = $facebook->getLoginUrl(
array(
'req_perms' => 'email'
)
);

Are there other methods than emailing a verification link to verify account info?

At the moment, we are sending an email address verification email each time someone signs up. This email has been causing a number of problems: people don't get it, they just don't click the link in the email or the email gets block by spam or some other method. We are working on resolving the spam issue, although I don't think it's possible to completely resolve it.
I'm wondering what other methods there might be for verifying and email address. Is there any other way to verify an email address without sending an email? Or is there another method of ensuring people aren't signing up with fake information?
I'm not sure if there are other good methods, but sending an email and having them click a link is definitely the simplest and most accurate.
A main feature to sending that email, is for the person to verify that it's actually them that requested it.
The only way to verify someone owns an email address is to have him use it.
As for verifying users don't enter fake information - not even sending an email can help. With so many disposable/temporary email services out there (like GuerrillaMail) , someone can fill up your form with false info, post a temp email address, log to that address and click the link in your email - manually or programatically.
You have to trust your users to come back for your content, and ignore spammers.
strikeiron.com offers a paid web service to verify if an email exists without sending a message to that email. try it out here is the link: strick
http://www.strikeiron.com/Catalog/ProductDetail.aspx?pv=5.0.0&pn=Email+Verification