[Action Advised] Enable email enumeration protection on all of your Firebase projects

[appsgenie]

I got this email from Firebase titled [Action Advised] Enable email enumeration protection on all of your Firebase projects. Could someone help me understand if this affects the rn firebase package too, if we enable this protection? The email links to https://cloud.google.com/identity-platform/docs/admin/email-enumeration-protection. It mentions the native fetchSignInMethodsForEmail method; I only use signInWithEmailAndPassword and wondering if they are connected?
thank you in advance

[tharwi]

I have the same question

[mikehardy]

signInWithEmailAndPassword will work fine

But if you enable email enumeration protection then fetchSignInMethodsForEmail will return an empty array, as they document upstream in the description of how APIs respond differently with protection enabled.

There is nothing more to it than that. If you turn email enumeration protection on, you will no longer get a useful response to fetchSignInMethodsWithEmail and will need to do something different (or not enable email enumeration protection...) if that was important to you

[appsgenie]

got it. so if not using fetchSignInMethodsForEmail then should be safe to enabled enumeration protection? I am currently using a custom method to check if the email a user types to try to login with is existing in the database.

[mikehardy]

I cannot answer what is safe or not for you. I have stated what the impact is in my comment and you'll have to test + decide for your project's sake