Authentication in iOS Apps

# CHAPTER 23

Authentication in iOS Apps #

1. Introduction #

2. Learning Objectives #

• Enable Email/Password authentication in the Firebase Console.

• Utilize the Auth.auth().createUser method to register new users.

• Utilize the Auth.auth().signIn method to authenticate existing users.

• Retrieve the unique User ID (UID) for database authorization.

• Listen to global authentication state changes to dynamically swap UI screens.

3. Enabling Authentication in Firebase #

1. 1. Open the Firebase Web Console.

1. 2. Navigate to Authentication in the left sidebar.

1. 3. Click Get Started, then click the Sign-in method tab.

1. 4. Select Email/Password, toggle it to "Enable", and click Save.

4. Creating a User Account (Sign Up) #

import Foundation
import FirebaseAuth

@MainActor
class AuthViewModel: ObservableObject {
    
    // The Signup Function!
    func createAccount(email: String, pass: String) async {
        do {
            // We ask Firebase to create the user securely!
            // This is asynchronous, so we must 'try await'
            let result = try await Auth.auth().createUser(withEmail: email, password: pass)
            
            // If successful, Firebase generates a massive, unique, unguessable String (UID)
            print("Successfully created account! User ID: \(result.user.uid)")
            
        } catch {
            print("Failed to create account: \(error.localizedDescription)")
        }
    }
}

5. Logging In (Authentication) #

func login(email: String, pass: String) async {
    do {
        // Firebase checks its secure vault to see if the password matches
        let result = try await Auth.auth().signIn(withEmail: email, password: pass)
        
        print("Welcome back! Your ID is: \(result.user.uid)")
        
    } catch {
        print("Login failed: \(error.localizedDescription)")
    }
}

*Note: Firebase requires passwords to be at least 6 characters long by default. If it is shorter, the do-catch block will catch a specific Firebase error!*

6. Managing the Session (The "Magic" Switch) #

import FirebaseAuth

@MainActor
class SessionManager: ObservableObject {
    // This tracks if someone is logged in!
    @Published var currentUser: User?
    
    init() {
        // When the app launches, we ask Firebase: "Is someone currently logged in?"
        self.currentUser = Auth.auth().currentUser
    }
    
    func logout() {
        do {
            try Auth.auth().signOut()
            self.currentUser = nil // Instantly redraws the UI!
        } catch {
            print("Error signing out.")
        }
    }
}

7. Mini Project: The Protected Screen UI #

import SwiftUI

struct RootView: View {
    // Instantiate our Session Manager
    @StateObject private var session = SessionManager()
    
    var body: some View {
        Group {
            // The Traffic Cop Logic!
            if session.currentUser != nil {
                // If a user exists, show the protected main app!
                MainAppDashboard()
            } else {
                // If they are nil, trap them on the login screen!
                LoginScreenView()
            }
        }
        // We inject the session into the environment so ANY screen can call session.logout()!
        .environmentObject(session)
    }
}

8. Common Mistakes #

• Logging In from Background Threads: If you execute the Firebase login function, and then attempt to immediately change a @Published property (like self.isLoggedIn = true) to swap the screens, you will trigger a Main Thread violation unless your ViewModel is explicitly marked with @MainActor.

• Hardcoding Passwords: Never, ever hardcode testing credentials in your UI views. Always capture them dynamically via a SecureField two-way binding.

9. Best Practices #

• Security Rules Mapping: Once you have a Firebase UID (result.user.uid), you should use that exact UID as the document ID when saving their profile data in the Firestore database. This allows you to write a strict Firebase Security Rule: *"Only allow a user to edit this document if the document ID matches their Authentication UID."*

10. Exercises #

1. 1. Write the explicit Firebase Swift command required to log a user out of the application securely.

1. 2. Explain how the SessionManager in Section 6 knows the user is logged in even after the app has been completely closed and reopened.

11. Coding Challenges #

12. MCQ Quiz with Answers #

13. Interview Questions #

• Q: Explain the immense architectural danger of rolling a custom authentication system (password hashing, salting, database storage) versus utilizing an enterprise BaaS solution like FirebaseAuth.

• Q: Describe the concept of a "Session State". How does FirebaseAuth maintain persistent sessions across application terminations, and how can SwiftUI react to these state changes?

• Q: In a production application, detail the mechanism by which the root UI (WindowGroup) acts as a router, dynamically swapping between an authentication flow and the main application dashboard based on the presence of a user token.

14. FAQs #

15. Summary #

16. Next Chapter Recommendation #