I have an Android App that use OTP (One time password) to authenticate the user the first time with their Phone number.
How can I do this in Back-end ? Do I store the phone number ? Do I generate a token ?
As OTP stands for One Time Password, just you need to generate a random number or sth combination of valid characters (token) with a specific length (at least 4 digits) and then store it with creation time for the requesting user in database for evaluation purpose.
This is necessary to store a valid email address before activating OTP mechanism, since a user may lost his phone or change the phone number and there should be a fallback solution in order to set a new one. An email won't change or disturb during the time as it has its own recovery mechanism.
In this way, This is not required to generate a globally unique OTP each time a user requests. The OTP is user specific which is valid for a short time since its generation time. You can implement other security mechanisms like maximum allowed failures or increase the OTP length up to 8 digits (or combining with valid characters, but keep it as short as possible) to enhance it based on your project sensitivity.
This is a deliberate decision to add another recovery/security options like employing Security questions which are very useful in special cases. Now let's answer your questions more detailed:
How can I do this in Back-end ?
You have to store any value (creation time for OTP too) and then do the validation based on them.
Do I store the phone number ?
Yes, You have to store it for each user. You can store some alternative phone numbers too, based on your preferred design. In this way, each phone number should be added in a secure manner, perhaps by validating first(primary) phone number.
Do I generate a token ?
A security token which may be made up of digits or valid characters is required to be generated, saved and sent to the target user, in order to have an OTP validation mechanism.
The answer is yes. You need to generate and store a unique token of the user and store phone number along with that into the database. Also you need to store that unique token into the mobile device as well.
Assuming that when user lost mobile phone then we can easily recover our old phone number (normally, it is possible in india after blocking sim card)
So, consider the following scenario:
1). User lost the mobile phone
In this case, as per my assumption, the mobile number is not going to change. So, after some time / days when the user tries to login with the same mobile number then you need to store a uniquely generated token to the user’s new mobile device.
2). User changes the phone number
In this case, our unique token comes into the picture. Using android, you can fetch the sim cards and phone number of that sim card. After reading the new phone number send OTP to that number. If verification is successful then on the backend side you need to pass 2 params, a unique token which was already stored into the mobile device and a new phone number. You need to check into the database for that unique token and simply update the new phone number for that token.
You can make a separate collection/table for storing token/otp in your database. Use a uniquely generated id for the user and use that id to refer to other collections. Since you plan to allow users to change mobile numbers, having the mobile number to identify users is not a good choice.
There are 2 cases in your application :
When number remains the same: Generate a random number and store it in the database along with the unique user id and delete all the previous tokens/otp for the given user id so that old otps cannot be used again, also add a time stamp and check it with your android app that and reject otps that were entered x minutes after they were generated. You can also use CRON job on your backend to delete the otps after a certain amount of time but just comparing the time on your android app will suffice.
When you change numbers: generate otp using the above method, for added security add a field to in the user table/object in your db to mark if the number is to be changed or not. When you will receive the otp you can lookup using the user's unique id and change the number if the flag is set to true and set the flag to false once you change the number otherwise you can throw an error as the number was not meant to be changed with the otp that was generated. Make sure to set the flag to false when the normal otp API is called.
