알림: 사용자가 정책을 준수하지 않는 비밀번호를 사용하여 가입할 수 있습니다. 정책 충족 필수 기준에서 누락된 기준이 있으면 반환됩니다. 반환되는 기준은 다음과 같습니다.
MISSING_LOWERCASE_CHARACTER
MISSING_UPPERCASE_CHARACTER
MISSING_NUMERIC_CHARACTER
MISSING_NON_ALPHANUMERIC_CHARACTER
MINIMUM_PASSWORD_LENGTH
MAXIMUM_PASSWORD_LENGTH
이 정보를 사용자에게 전송하여 비밀번호를 업데이트하도록 알릴 수 있습니다. 다음 예시는 누락된 비밀번호 기준이 포함된 응답을 보여줍니다.
{"kind":"identitytoolkit#VerifyPasswordResponse","localId":"CJL1i2","email":"cloudysanfrancisco@gmail.com","displayName":"","idToken":"ID_TOKEN","registered":true,"userNotifications":[{"notificationCode":"MISSING_NUMERIC_CHARACTER","notificationMessage":"Password must contain a numeric character"},{"notificationCode":"MISSING_NON_ALPHANUMERIC_CHARACTER","notificationMessage":"Password must contain a non-alphanumeric character"}]}
새 사용자는 해당 정책에 따라 비밀번호를 선택해야 합니다.
활성 사용자가 있으면 비밀번호 정책을 즉시 적용하려는 경우가 아니면 로그인 강제 업그레이드를 사용 설정하지 않는 것이 좋습니다. 대신 사용자가 자신의 현재 비밀번호를 사용해서 로그인할 수 있게 해주고 비밀번호에 부족한 요구사항에 대해 자세한 알림을 전송하는 알림 모드를 사용하세요.
적용을 사용 설정할 때 forceUpgradeOnSignin를 true로 설정하여 필수 모드로 시행을 사용 설정하세요. 알림 모드에서 적용을 사용 설정하려면 false로 설정합니다.
import{getAuth}from'firebase-admin/auth';// Update project config with password policy configgetAuth().projectConfigManager().updateProjectConfig({passwordPolicyConfig:{enforcementState:'ENFORCE',forceUpgradeOnSignin:true,constraints:{requireUppercase:true,requireLowercase:true,requireNonAlphanumeric:true,requireNumeric:true,minLength:MIN_PASSWORD_LENGTH,maxLength:MAX_PASSWORD_LENGTH,},},})
다음을 바꿉니다.
MIN_PASSWORD_LENGTH: 필수 비밀번호 최소 길이
MAX_PASSWORD_LENGTH: 필수 비밀번호 최대 길이
테넌트 수준에서 비밀번호 정책을 적용하려면 다음을 실행합니다.
import{getAuth}from'firebase-admin/auth';// Update project config with password policy configgetAuth().tenantManager().createTenant({displayName:"admin-tenant",passwordPolicyConfig:{enforcementState:'ENFORCE',forceUpgradeOnSignin:true,constraints:{requireUppercase:true,requireLowercase:true,requireNonAlphanumeric:true,requireNumeric:true,minLength:MIN_PASSWORD_LENGTH,maxLength:MAX_PASSWORD_LENGTH,},},})
적용 사용 중지
프로젝트 수준에서 비밀번호 정책 적용을 사용 중지하려면 다음을 실행합니다.
import{getAuth}from'firebase-admin/auth';// Update project config with password policy configgetAuth().projectConfigManager().updateProjectConfig({passwordPolicyConfig:{enforcementState:'OFF',},})
테넌트 수준에서 비밀번호 정책 적용을 사용 중지하려면 다음을 실행합니다.
import{getAuth}from'firebase-admin/auth';// Update tenant config with password policy configgetAuth().tenantManager().updateTenant(TENANT-ID,{passwordPolicyConfig:{enforcementState:'OFF',},})
TENANT-ID를 비밀번호 정책을 사용 중지할 테넌트 ID로 바꿉니다.
클라이언트 측에 적용
제출하기 전에 클라이언트 측의 프로젝트 또는 테넌트에 대한 비밀번호 정책을 기준으로 비밀번호의 유효성을 검사할 수 있습니다.
import{getAuth,validatePassword}from'firebase/auth';constauth=getAuth();auth.tenantId=TENANT-ID;conststatus=awaitvalidatePassword(auth,'password').catch((error)=>{// Password could not be validated.});constpolicy=status.passwordPolicy;// Use the status and policy to show what requirements are met and which are missing.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003ePassword policies enhance security by enforcing complexity requirements, such as lowercase, uppercase, numeric, and non-alphanumeric characters, along with minimum and maximum length.\u003c/p\u003e\n"],["\u003cp\u003ePassword policy enforcement can be set to "Require," failing sign-ups until password compliance, or "Notify," allowing sign-ups with non-compliant passwords but notifying users of missing criteria.\u003c/p\u003e\n"],["\u003cp\u003ePassword policy can be enforced at the project or tenant level, with the option to immediately enforce or use a notification-based approach for existing users.\u003c/p\u003e\n"],["\u003cp\u003eEnforcement can be disabled at either the project or tenant level by setting the \u003ccode\u003eenforcementState\u003c/code\u003e to \u003ccode\u003eOFF\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003ePasswords can be validated on the client-side before submission to check if they comply with the project or tenant's password policy.\u003c/p\u003e\n"]]],[],null,["# Enable, disable, and use password policies\n==========================================\n\nThis document shows you how to use password policies to improve password\nstrength for new and existing users.\n\nOverview\n--------\n\nWith password policies, you can improve account security by enforcing password\ncomplexity requirements. Password policies support the following password\nrequirements:\n\n- Lowercase character required\n- Uppercase character required\n- Numeric character required\n- Non-alphanumeric character required\n- Minimum password length (ranges from 6 to 30 characters; defaults to 6)\n- Maximum password length (maximum length of 4096 characters)\n\nThe following characters satisfy the non-alphanumeric character requirement if\nconfigured:\n\n``^ $ * . [ ] { } ( ) ? \" ! @ # % & / \\ , \u003e \u003c ' : ; | _ ~ ```\n\nBefore you begin\n----------------\n\n- Install the [admin SDK](/identity-platform/docs/install-admin-sdk)\n\nEnforcement modes\n-----------------\n\nYou can enable password policy enforcement in two modes:\n\n- Require: Attempts to sign up fail until the user updates to a password that complies with your policy.\n- Notify: Users are allowed to sign up with a non-compliant password. Any\n missing criteria needed to satisfy the policy are returned. Criteria returned\n include:\n\n - `MISSING_LOWERCASE_CHARACTER`\n - `MISSING_UPPERCASE_CHARACTER`\n - `MISSING_NUMERIC_CHARACTER`\n - `MISSING_NON_ALPHANUMERIC_CHARACTER`\n - `MINIMUM_PASSWORD_LENGTH`\n - `MAXIMUM_PASSWORD_LENGTH`\n\n | **Note:** Password criteria parameters are not available in the client SDK. See [Enforcing on the client side](#enforcing_on_the_client_side) for how to validate passwords using the client SDK.\n\n You can send this information to the user to inform them to update their\n password. The following example shows a response containing missing\n password criteria: \n\n {\n \"kind\": \"identitytoolkit#VerifyPasswordResponse\",\n \"localId\": \"CJL1i2\",\n \"email\": \"cloudysanfrancisco@gmail.com\",\n \"displayName\": \"\",\n \"idToken\": \"ID_TOKEN\",\n \"registered\": true,\n \"userNotifications\": [\n {\n \"notificationCode\": \"MISSING_NUMERIC_CHARACTER\",\n \"notificationMessage\": \"Password must contain a numeric character\"\n },\n {\n \"notificationCode\": \"MISSING_NON_ALPHANUMERIC_CHARACTER\",\n \"notificationMessage\": \"Password must contain a non-alphanumeric character\"\n }\n ]\n }\n\nNew users are required to choose a password that complies with your policy.\nIf you have active users, we recommend not enabling force upgrade on sign in\nunless you intend to immediately enforce the password policy. Instead, use\nnotify mode, which allows users to sign in with their current passwords\nand sends notifications that detail the requirements their password lacks.\n\nWhen you enable enforcement, set `forceUpgradeOnSignin` to `true` to enable enforcement\nin require mode. Set it to `false` to enable enforcment in notify mode.\n\nEnable enforcement\n------------------\n\nTo enforce a password policy, do the following:\n\n1. If you haven't already done so, configure [email and password sign-in](/identity-platform/docs/quickstart-email-password).\n2. To enforce a password policy at the project level, run the following:\n\n import { getAuth } from 'firebase-admin/auth';\n\n // Update project config with password policy config\n getAuth().projectConfigManager().updateProjectConfig({\n passwordPolicyConfig: {\n enforcementState: 'ENFORCE',\n forceUpgradeOnSignin: true,\n constraints: {\n requireUppercase: true,\n requireLowercase: true,\n requireNonAlphanumeric: true,\n requireNumeric: true,\n minLength: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eMIN_PASSWORD_LENGTH\u003c/span\u003e\u003c/var\u003e,\n maxLength: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eMAX_PASSWORD_LENGTH\u003c/span\u003e\u003c/var\u003e,\n },\n },\n })\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eMIN_PASSWORD_LENGTH\u003c/var\u003e: the minimum required password length\n - \u003cvar translate=\"no\"\u003eMAX_PASSWORD_LENGTH\u003c/var\u003e: the maximum required password length\n3. To enforce a password policy at the tenant level, run the following:\n\n import { getAuth } from 'firebase-admin/auth';\n\n // Update project config with password policy config\n getAuth().tenantManager().createTenant({\n displayName: \"admin-tenant\",\n passwordPolicyConfig: {\n enforcementState: 'ENFORCE',\n forceUpgradeOnSignin: true,\n constraints: {\n requireUppercase: true,\n requireLowercase: true,\n requireNonAlphanumeric: true,\n requireNumeric: true,\n minLength: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eMIN_PASSWORD_LENGTH\u003c/span\u003e\u003c/var\u003e,\n maxLength: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eMAX_PASSWORD_LENGTH\u003c/span\u003e\u003c/var\u003e,\n },\n },\n })\n\nDisable enforcement\n-------------------\n\n1. To disable password policy enforcement at the project level, run the following:\n\n import { getAuth } from 'firebase-admin/auth';\n\n // Update project config with password policy config\n getAuth().projectConfigManager().updateProjectConfig({\n passwordPolicyConfig: {\n enforcementState: 'OFF',\n },\n })\n\n2. To disable password policy enforcement at the tenant level, run the following:\n\n import { getAuth } from 'firebase-admin/auth';\n\n // Update tenant config with password policy config\n getAuth().tenantManager().updateTenant(\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eTENANT\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eID\u003c/span\u003e\u003c/var\u003e, {\n passwordPolicyConfig: {\n enforcementState: 'OFF',\n },\n })\n\n Replace `TENANT-ID` with the tenant ID you want to disable a\n password policy for.\n\nEnforcing on the client side\n----------------------------\n\nPasswords can be validated against the password policy for the project or a tenant\non the client side before submission. \n\n import { getAuth, validatePassword } from 'firebase/auth';\n\n const auth = getAuth();\n auth.tenantId = \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eTENANT\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-nx\"\u003eID\u003c/span\u003e\u003c/var\u003e;\n\n const status = await validatePassword(auth, 'password').catch((error) =\u003e {\n // Password could not be validated.\n });\n const policy = status.passwordPolicy;\n\n // Use the status and policy to show what requirements are met and which are missing."]]
