SecureHaven

An Android application implementing email and password authentication with Firebase Authentication. Users register an account and sign in, with credentials verified against Firebase rather than stored or checked on the device.

Written in Java for the Android SDK, using Firebase Auth for identity and Material Components for the interface.

---

Features

Account registration — creates a new user through FirebaseAuth.createUserWithEmailAndPassword(), with the result handled asynchronously and success or failure reported back to the user.

Sign in — authenticates existing users via FirebaseAuth.signInWithEmailAndPassword(), showing a clear message when credentials are rejected.

Client-side input validation — before any network call is made, each field is checked and errors are surfaced inline on the offending input via setError() with focus moved to it:

Rule	Applied to
Field must not be empty	Email, password
Must match Patterns.EMAIL_ADDRESS	Email
Minimum length of 6 characters	Password

Validating before dispatch avoids pointless network round trips and gives the user immediate, field-level feedback.

No local credential storage — passwords are never written to device storage or transmitted to a custom backend. Firebase handles hashing, storage and session management, which removes an entire class of credential-handling mistakes from the app itself.

Material Design interface — layouts built with Material Components, supporting both light and dark themes.

---

Tech stack

Layer	Technology
Language	Java 8
Platform	Android SDK (min 21 / target 32)
Authentication	Firebase Authentication 21.0.1
UI	Material Components 1.5.0, AndroidX AppCompat 1.4.1
Build	Gradle with Google Services plugin
Testing	JUnit 4, Espresso

Minimum SDK 21 covers Android 5.0 Lollipop and above.

---

Getting started

Prerequisites

• Android Studio
• JDK 8 or newer
• A Firebase project

Setup

1. Clone the repository:

   git clone https://github.com/novaxertz/securehaven-android.git

2. Create a Firebase project at the Firebase Console.

3. Add an Android app to the project using the package name com.example.securehaven_v1.

4. Under Authentication → Sign-in method, enable the Email/Password provider. Registration and sign-in both fail without this.

5. Download the generated google-services.json and place it in the app/ directory.

6. Open the project in Android Studio, let Gradle sync, then run on an emulator or device.

---

Project structure

app/src/main/java/com/example/securehaven_v1/
  login.java              Sign-in screen - validation and FirebaseAuth sign-in
  registration.java       Registration screen - validation and account creation

app/src/main/res/layout/
  login.xml               Sign-in layout
  registration.xml        Registration layout

app/src/main/
  AndroidManifest.xml     App manifest
app/
  build.gradle            Module dependencies and SDK configuration
  google-services.json    Firebase configuration

---

How authentication works

Firebase Authentication is used as the identity provider, so the app never handles password storage itself:

1. The user enters an email and password
2. The app validates the input locally and rejects it early if malformed
3. FirebaseAuth is called — createUserWithEmailAndPassword for registration, signInWithEmailAndPassword for login
4. The call is asynchronous; the result is handled in an OnCompleteListener
5. On success the user proceeds; on failure a Toast reports the problem without disclosing which part of the credential was wrong

That last detail is deliberate. A generic "please check your login credentials" message avoids revealing whether an email is registered, which would otherwise let an attacker enumerate valid accounts.

---

Status and known limitations

This is an early version (v1) built while learning Android and Firebase, published as-is. Known issues, documented rather than hidden:

• No activities are declared in AndroidManifest.xml. The <application> element is self-closing, so neither login nor registration is registered and no launcher intent filter exists. The project compiles but will not start until the activities are declared and one is marked as LAUNCHER.
• INTERNET permission is not declared, which Firebase requires for network calls.
• Successful login navigates back to the login screen. login.java starts login.class on success, so there is no post-authentication destination yet.
• A validation message is misleading — the password rule says "length of password is more than 6" when the check enforces a minimum of 6.
• No password reset, email verification, or session persistence check. A returning user is not routed past the login screen automatically.
• Class names are lowercase (login, registration), against Java convention, which expects LoginActivity and RegistrationActivity.
• google-services.json is committed. For Android this file is not strictly a secret — Google documents the client API key as an identifier rather than a credential, with real protection coming from Firebase Security Rules and per-key restrictions. It is still common practice to keep it out of public repositories, and anyone forking this will need to supply their own.

---

Roadmap

• Declare both activities in the manifest and set a launcher intent filter
• Add the INTERNET permission
• Build a home screen to land on after successful authentication
• Rename classes to LoginActivity / RegistrationActivity
• Add password reset and email verification flows
• Check for an existing session on startup and skip login when one is active
• Replace Toast messages with inline error states

---

Author

Ibrahim Ansar GitHub · LinkedIn