How to Handle Anonymous Users in Firebase Auth

1import { getAuth, signInAnonymously, onAuthStateChanged } from 'firebase/auth'
2
3const auth = getAuth()
4
5async function signInAsGuest() {
6  try {
7    const userCredential = await signInAnonymously(auth)
8    const user = userCredential.user
9    console.log('Anonymous UID:', user.uid)
10    console.log('Is anonymous:', user.isAnonymous) // true
11    return user
12  } catch (error: any) {
13    console.error('Anonymous sign-in failed:', error.code)
14    throw error
15  }
16}

1import { getAuth, onAuthStateChanged } from 'firebase/auth'
2import { useEffect, useState } from 'react'
3
4function useAuthState() {
5  const [user, setUser] = useState<any>(null)
6  const [isAnonymous, setIsAnonymous] = useState(false)
7  const [loading, setLoading] = useState(true)
8
9  useEffect(() => {
10    const auth = getAuth()
11    const unsubscribe = onAuthStateChanged(auth, (firebaseUser) => {
12      setUser(firebaseUser)
13      setIsAnonymous(firebaseUser?.isAnonymous ?? false)
14      setLoading(false)
15    })
16    return () => unsubscribe()
17  }, [])
18
19  return { user, isAnonymous, loading }
20}
21
22// Usage in a component:
23// const { user, isAnonymous } = useAuthState()
24// if (isAnonymous) show 'Create account' banner

1import { getAuth, EmailAuthProvider, linkWithCredential } from 'firebase/auth'
2
3const auth = getAuth()
4
5async function linkEmailPassword(email: string, password: string) {
6  const user = auth.currentUser
7  if (!user || !user.isAnonymous) {
8    throw new Error('No anonymous user to link')
9  }
10
11  const credential = EmailAuthProvider.credential(email, password)
12
13  try {
14    const result = await linkWithCredential(user, credential)
15    console.log('Account linked. UID preserved:', result.user.uid)
16    console.log('Is anonymous:', result.user.isAnonymous) // false
17    return result.user
18  } catch (error: any) {
19    if (error.code === 'auth/email-already-in-use') {
20      console.error('This email is already registered. Sign in instead.')
21    }
22    throw error
23  }
24}

1import { getAuth, GoogleAuthProvider, linkWithPopup } from 'firebase/auth'
2
3const auth = getAuth()
4
5async function linkGoogleAccount() {
6  const user = auth.currentUser
7  if (!user || !user.isAnonymous) {
8    throw new Error('No anonymous user to link')
9  }
10
11  const provider = new GoogleAuthProvider()
12
13  try {
14    const result = await linkWithPopup(user, provider)
15    console.log('Google account linked. UID:', result.user.uid)
16    return result.user
17  } catch (error: any) {
18    if (error.code === 'auth/credential-already-in-use') {
19      console.error('This Google account is linked to another user.')
20      // Consider merging data from anonymous to existing account
21    }
22    throw error
23  }
24}

1// firestore.rules
2rules_version = '2';
3service cloud.firestore {
4  match /databases/{database}/documents {
5
6    // Public data: any authenticated user (including anonymous) can read
7    match /products/{productId} {
8      allow read: if request.auth != null;
9      allow write: if request.auth != null
10        && request.auth.token.firebase.sign_in_provider != 'anonymous';
11    }
12
13    // User data: scoped to their UID (works for both anonymous and permanent)
14    match /carts/{userId}/{document=**} {
15      allow read, write: if request.auth != null
16        && request.auth.uid == userId;
17    }
18
19    // Orders: require a permanent account
20    match /orders/{orderId} {
21      allow create: if request.auth != null
22        && request.auth.token.firebase.sign_in_provider != 'anonymous';
23      allow read: if request.auth != null
24        && request.auth.uid == resource.data.userId;
25    }
26  }
27}

1// Cloud Function to clean up old anonymous accounts
2import { onSchedule } from 'firebase-functions/v2/scheduler'
3import { getAuth } from 'firebase-admin/auth'
4import { initializeApp } from 'firebase-admin/app'
5
6initializeApp()
7
8export const cleanupAnonymousUsers = onSchedule('every day 02:00', async () => {
9  const auth = getAuth()
10  const cutoff = Date.now() - 30 * 24 * 60 * 60 * 1000 // 30 days
11
12  let nextPageToken: string | undefined
13  do {
14    const listResult = await auth.listUsers(1000, nextPageToken)
15    const toDelete = listResult.users
16      .filter(user => {
17        const isAnon = user.providerData.length === 0
18        const lastSignIn = new Date(user.metadata.lastSignInTime).getTime()
19        return isAnon && lastSignIn < cutoff
20      })
21      .map(user => user.uid)
22
23    if (toDelete.length > 0) {
24      await auth.deleteUsers(toDelete)
25      console.log(`Deleted ${toDelete.length} anonymous users`)
26    }
27
28    nextPageToken = listResult.pageToken
29  } while (nextPageToken)
30})