[Flutter] Firebase Auth: Google Sign-In Overwrites Existing Email/Password Account in Flutter

I'm developing a Flutter app using Firebase for authentication, and I'm encountering an issue with Google Sign-In.

In my app, users can sign up and sign in with email/password, and I've also added the option to sign in with Google. Both work fine independently.

However, when a user already has an account with email/password and later tries to sign in with Google (using the same email), it seems to overwrite their password. This prevents the user from signing back in with their original email/password credentials.

I tried using fetchSignInMethodsForEmail() to check if the email is already registered, and if it is, I attempt to link the Google credentials with linkWithCredential(), but the problem persists.

Future<Either<AppException, UserCredential>> signInWithGoogle() async {
try {
final GoogleSignInAccount? googleUser = await _googleSignIn.signIn();
if (googleUser == null) {
return Left(AppException(AppErrorMessages.googleSignInCancelled));
}

final GoogleSignInAuthentication googleAuth =
await googleUser.authentication;

final OAuthCredential credential = GoogleAuthProvider.credential(
accessToken: googleAuth.accessToken,
idToken: googleAuth.idToken,
);

final UserCredential userCredential =
await _auth.signInWithCredential(credential);

return Right(userCredential);
} on FirebaseAuthException catch (e) {
if (e.code == 'account-exists-with-different-credential') {
return Left(AppException(
AppErrorMessages.accountExistsWithDifferentCredential));
} else {
return Left(AppException(AppException.mapFirebaseAuthError(e)));
}
} catch (e) {
return Left(AppException('${AppErrorMessages.unexpectedError}: $e'));
}
}


Even though I check the sign-in methods and try to link the credentials correctly, Firebase seems to overwrite the user’s email/password. After linking Google, the user is forced to use Google Sign-In and can no longer use their previous password to log in.

Question:

How can I prevent Firebase from overwriting the password when a user signs in with Google? Is there a proper way to handle multiple providers without causing this issue? Any help or guidance would be greatly appreciated, as I want to avoid forcing users to reset their password or only use Google for future sign-ins.

Continue reading...