且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

是否可以通过用户的UID从FirebaseAuth中删除用户?

更新时间:2022-06-18 02:36:32

登录的用户只能删除自己的帐户。无论使用哪种平台,任何用户都没有能力或权限从您的客户端Web或移动应用程序中删除另一个帐户。实际上,这将是一个巨大的安全漏洞。

A user signed in can only delete their own account. No user has ability or permission to delete another account from your client web or mobile app, not matter what platform. That would actually be a huge security hole.

您可以做的是使用 Firebase管理SDK ,它具有管理用户。特权后端代码可以通过UID删除任何用户。如果您打算让最终用户在后端调用某些功能以删除另一个用户,则应在后端代码中验证该用户应具有此特权。

What you can do instead is delete the user from a backend you control using the Firebase Admin SDK, which has the ability to manage users. Privileged backend code can delete any user by UID. If you intend for your end users to invoke some function on your backend that deletes another user, you should verify in your backend code that the user should have this privilege.