How to disable Firebase Phone Auth Android auto-sign-in (onVerificationCompleted callback)

user_3889068 0
Viewed 9876

Is there a way to disable Android "instant verification" (automatically signing in) with Firebase Phone Auth? There is a way to disable "auto-retrieval" by setting the timeout of verifyPhoneNumber to 0 (Reference: https://firebase.google.com/docs/reference/android/com/google/firebase/auth/PhoneAuthProvider.html). However I cannot find a documented way to disable instant verification.

I am asking because of a potential security issue: removing the SIM card from a device still auto-signs in that user! In other words, a user using another person's old device could be able to sign in using their old phone number. Here are the reproduction steps:

  • Be on Android, on a device with a functional SIM card
  • Sign in using the number associated with that SIM card
  • This triggers auto-sign-in
  • Sign out
  • Turn device off and remove SIM card
  • Turn device back on and attempt signing in with that same number

Observed behavior: The user is auto-signed in, despite not having the appropriate SIM card

Expected behavior: If the user's device does not have a SIM card that is associated with the entered phone number, they are not auto-signed-in and an SMS text message is sent to that number.

firebase-authentication firebase android
5 Answers

Not sure when this feature was added, but you can actually add a fake phone number and expected verification code which will override the auto verification: enter image description here

user_45485000

No need to change SIM Card!!!!

In order to get OTP/Code multiple time for testing just follow this code in oncreate of your activity you will get code now uninstall the app and verify again you will get a new code it will not instant validate.

if you still not able to do that i will share my full activity code!!

 PhoneAuthProvider.getInstance().verifyPhoneNumber(
            phoneNumber,        // Phone number to verify
            60,                 // Timeout duration
            TimeUnit.SECONDS,   // Unit of timeout
            this,               // Activity (for callback binding)
            mCallbacks);        // OnVerificationStateChangedCallbacks
    // [END start_phone_auth]

    mVerificationInProgress = true;
user_70311180
Related