Firebase auth: update lost phone number

user_6662393 0
Viewed 235

When a user has lost their phone number, and they want to update their account with a new phone number, what would be the best path to follow? We already have their email.

The problem is Firebase needs to send an SMS to the old phone number before updating it, which the user has lost.

My best idea so far is to authenticate them with their email, then send a request to our backend with the new phone number they entered, and then use the Firebase Admin SDK to update the user's phone number. There's just one problem here: How would I verify this new phone number, to make sure the user didn't just add some random one?

firebase-authentication firebase
2 Answers

I'm answering my own question with the path that I followed:

First, we get their email and send a verification email, which contains a button that redirect to a deeplink that contains a token that we use on the backend to verify that the user indeed is who they claim to be.

After the user clicks the link, we show a screen on the app that asks for the new phone number.

After the new phone number is entered, we send it to our backend, along with the token on the deeplink. We verify the token, then use Twilio to send a verification SMS to this new number.

In the meantime, the user has already been sent to the verification code screen. They get the Twilio SMS and put in the code. We send this code to our backend and make sure the code they entered is correct.

If the code is correct, we use the Firebase Admin API to update this user's phone number to the new one.

user_66623930

Firebase has a method for phone authentication

For Android: https://firebase.google.com/docs/auth/android/phone-auth?authuser=0#send-a-verification-code-to-the-users-phone

For Web: https://firebase.google.com/docs/auth/web/phone-auth#send-a-verification-code-to-the-users-phone

For IOS: https://firebase.google.com/docs/auth/ios/phone-auth?authuser=0#send-a-verification-code-to-the-users-phone

Edit

The way to change a user's phone number is through the method below

PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, code);
FirebaseUser user = FirebaseAuth.getInstance().getCurrentUser();
    user.updatePhoneNumber(credentials)
            .addOnCompleteListener(new OnCompleteListener<Void>() {
                @Override
                public void onComplete(@NonNull Task<Void> task) {
                    if (task.isSuccessful()) {

                    }
                }
            });

The problem is you need to send a verification code to the user's old phone number (Links above) to create a PhoneAuthCredential (reference).

I do not know a way around that using firebase

user_71607520
Related