Regrettably, it is not possible to verify the email domain prior to registration without client-side validation.
You have a couple of options available to you:
- Option 1: Restrict access to the database and storage if the user's domain does not match specific domains:
For instance:
"rules": {
".read": "auth.token.email.endsWith('@gmail.com')",
".write": "auth.token.email.endsWith('@gmail.com')"
}
}
or something along these lines:
"rules": {
".read": "auth.token.email_verified == true && auth.token.email.matches(/.*@gmail.com$/)",
".write": "auth.token.email_verified == true && auth.token.email.matches(/.*@gmail.com$/)"
}
}
Credits:
- Option 2: Implement a Firebase Authentication trigger to monitor new users. This way, you can validate newly registered users and deactivate those with invalid domains:
For example:
exports.validateUser = functions.auth.user().onCreate((user) => {
if (!user.email.matches(/.*@gmail.com$/)) {
admin.auth().updateUser(data, {
disabled: true
});
}
});
Credits: https://firebase.google.com/docs/functions/auth-events