I have decided to implement some extra security processes in my app. Previously, I was updating the user password directly from the client side. I have decided to do it inside a Cloud Function, in order to also notify the user via email.

For this, I am passing the newPassword as param to my callable cloud function, where I execute:

admin.auth().updateUser(uid, {
   password: newPassword,
});

I have thought that it will also be a good idea, to increase the security, to make sure that the user writes his current password in the form, in order to verify it in my cloud function, before updating the password.

How can I compare the current user’s password in admin mode (GCF)?