I created this rule:
{
"rules": {
"supermarket": {
"usuarios": {
"$uid": {
".read": "auth != null && auth.uid == $uid",
".write": "auth != null && auth.uid == $uid"
}
}
}
}
}
I ran Get and Set tests in the rule testing lab, and both worked perfectly; however, when attempting to change the password in Kodular, I received an “access denied” message.
It was recorded in the database like this:
Hi dear,
Please explain better, what do get/set have to do with changing the password? In Kodular 
Edit:
Sorry, I didn’t realize that “senha” meant “password”
Anyway, did you follow the correct procedure to set up Firebase? Do you have the JSON file in the assets? Are you handling authentication correctly?
You can change the password using the accounts:update endpoint
POST https://identitytoolkit.googleapis.com/v1/accounts:update?key=YOUR_API_KEY
Content-Type: application/json
{
“idToken”: “USER_ID_TOKEN”,
“password”: “NewPassword123”,
“returnSecureToken”: true
}
Here’s the situation, everyone: I didn’t use the Google API for registration, login, and password reset. I handled the entire process this way.
I use this variable to store the UID—for use in other registration screens—and also to retrieve data from the database (Get Value).
User registration: Here, I only validate whether the passwords match. The intention is also to validate the username and email so that the user registers a unique username and email address. Example: registered in the database. username: carlos, email: ca@gmail.com
If he tries to register again or wants to edit his details (change username or email), a message appears stating that the username or email already exists.
After validation, the registration is performed in Firebase Authentication. I store the data—username, email, and password—based on the result of this registration.
Log In Block:
Here is how my password reset system works: when the user enters their username, I check if it exists. If it does, an email containing a 6-digit code is sent.
Once the user enters the code, I validate it. If it is correct, a screen opens for them to enter and confirm their new password.
Sorry for the length of the text, but I had to include the blocks to explain how everything was set up. Here is what happens when I try to register. Actually, it does allow registration or password changes, but Firebase returns an “access denied” message with these rules.
I know you’re going to ask why I didn’t use the Google API to make the code more concise, but I wanted to keep it exactly the way it is.
Can you help me?
There are several issues
Edit:
Could you be more specific and explain exactly when it happens?
here?
I believe this part isn’t needed, I didn’t come across the to the Firebase authentication component but I don’t think it’s support change password, if it does lucky u, that’s said the only option for this function is using the API which won’t access the database
Dear Ibrahim,
I don’t know if you read the topic carefully but Carlos is saving the login credentials directly in the database 
he doesn’t want to use APIs or anything else.
Even so I would prefer to help you use a secure method.
You are handling the conditions with AND, meaning the code only runs if all of them are true, use OR instead (textbox empty).
Response: Done. Modified!
Saving the password in plain text in the database is a bad practice, at the very least, it should be encrypted.
Response: I’m going to use the PasswordValidator extension.
You are generating the OTP on the client side, which doesn’t make sense.
X = “”, is better written as “not empty”.
X = true, you can remove the equality check since X is already true/false.
Response: And what would be the solution to this?
Could you be more specific and explain exactly when it happens?
Response:
Since I have vertical layouts for each action—Va_login, Vas_cadastro, Va_recuperasenha, Va_verificacodigo, and Va_nova_senha—the text boxes have different names.
The password was saved in the database under the name txt_senha_cadastro, while the new password is named tx_nova_senha; I followed the same process for the password confirmation.
Since the username and email will not be changed, I used the global variables nomeformatado and emailformatado in their place.
I did bros, that’s why I was confidently said that. The credentials are user concern’s, you can’t read user’s password without there concern, that said you can even use their account without them knowing
I can say it again 
it’s isn’t necessary to save users credentials here
Every user should be responsible for their account credentials, if they forget password, provide a reset password without you getting involved, if they want to change let them to change without knowing the new password, that’s how it works.
I repeat, this isn’t needed @Carlos_Alberto_Leonel
I am with @Ibrahim_Jamar on this.
Firebase offers all the elements for practical and secure user authentication, including OTP, email verification and password reset. Why replicate (or make a mess of) the whole thing in blocks, and also potentially breach your users privacy.
I agree with Ibrahim too, of course.
But in its current state, it is a serious problem, so we need to at least mitigate the issue as much as possible.
To address everyone: I built a login system using the Google API. It is very secure, but I wasn’t happy with the password reset process. In most apps, changing the password involves sending an email with a validation code; once the user enters and validates the code, a screen opens for them to enter and confirm the new password. Can I achieve this with the Google API? If such a solution exists, I’ll switch to that method.
Most users would expect that behaviour - reset password, get an email, follow the link, reset password.
There should be a disconnect from the app to the process…
As soon as I finish a project I have in mind, I’ll create a guide on how to take advantage of DeepLinks that, after an operation, redirect back to the app with a token, UUID, etc. (using Supabase, but since you pointed it out to me, I’ll probably also add a dedicated section for Firebase, since it’s very similar).
Yes. 100%. I remember that was last year, when you requested password reset, firebase send you a link to your email with a token id, I also believe that you won’t need a screen of confirm the otp for password reset. The link in your email can do it with a browser, only if the account is exist to firebase. And after a reset successful, a user can login with the new password
I’m trying to change the password reset email template. I used to do this without any issues. Now, look at this message:
Have you contacted Firebase Support, as suggested ?
I did it, and so far I haven’t received a response.
