Skip to content

fix(auth)!: remove non-functional MFA recovery codes - #2457

Open
demolaf wants to merge 1 commit into
version-10.0.0-beta05from
fix/remove-unverifiable-mfa-recovery-codes
Open

fix(auth)!: remove non-functional MFA recovery codes#2457
demolaf wants to merge 1 commit into
version-10.0.0-beta05from
fix/remove-unverifiable-mfa-recovery-codes

Conversation

@demolaf

@demolaf demolaf commented Aug 26, 2026

Copy link
Copy Markdown
Member

⚠️ Breaking Changes

Removes the MFA recovery-codes API surface. Pre-GA (10.0.0-beta05), so no deprecation cycle.

  • AuthUIStringProviderrecoveryCodesSavedAction, mfaStepShowRecoveryCodesTitle and mfaStepShowRecoveryCodesHelper are gone from the public interface. Anyone with a custom AuthUIStringProvider implementation will fail to compile ('recoveryCodesSavedAction' is not a member of supertype) until those overrides are deleted.
  • MfaConfiguration.enableRecoveryCodes — constructor parameter removed. It previously defaulted to true, so callers who never set it are unaffected at the source level; callers who passed it explicitly must drop the argument.
  • MfaEnrollmentStep.ShowRecoveryCodes — enum case removed. Any exhaustive when over MfaEnrollmentStep in a custom enrollment slot must drop that branch.
  • MfaEnrollmentContentState.recoveryCodes / .onCodesSavedClick — removed.
  • String resourcesfui_recovery_codes_saved_action, fui_mfa_step_show_recovery_codes_title and fui_mfa_step_show_recovery_codes_helper removed across all 85 locales.

Behaviour change: with recovery codes enabled (the previous default), onComplete fired when the user confirmed they had saved their codes. It now fires as soon as the second factor is verified — one interaction earlier.


Maintainer note: Fixes internal CPRN-379

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request removes the recovery (backup) codes feature from the Multi-Factor Authentication (MFA) enrollment flow across FirebaseUI Auth, as Firebase Authentication lacks a backup-code primitive to verify them at sign-in. The changes include removing the enableRecoveryCodes configuration option, deleting the ShowRecoveryCodes step and its associated UI components, removing localized string resources for recovery codes across all supported languages, and updating the documentation and tests accordingly. I have no feedback to provide as there are no review comments to assess.

@demolaf
demolaf force-pushed the fix/remove-unverifiable-mfa-recovery-codes branch from 237b403 to 2e4f64c Compare August 26, 2026 15:35
@demolaf
demolaf force-pushed the fix/remove-unverifiable-mfa-recovery-codes branch from 2e4f64c to 9504a08 Compare August 26, 2026 17:48
@demolaf
demolaf marked this pull request as ready for review August 26, 2026 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant