Phone Number with Password Authentication using Firebase

Question

In my current project, I'm registering a user with email ID and then in profile section when the user updates a phone number, I authenticate that phone number & using PhoneAuthCredetials I'm merging both Authentication methods for the same user.

Now the real pain is, My user can sign in with Phone number or Email ID but for Email ID user has to enter password & for phone number it'll need OTP. (I Tried that, Entered phone number & password for signInWithEmailAndPassword() but not worked)

I wanted the user to log in with email or phone with a password. the way Flipkart does.

Is there any way I can manage that?

They haven't released this type of feature where developer can implement the login with phone / gmail. Developer needs to choose either phone auth or email auth. This question is mostly related on upcoming updates from **Firebase** or you can use this method to do login https://stackoverflow.com/a/41201980/10182897 — Ashish, Jun 27 '19 at 10:26
@akshay I am also trying to implement this login/signup flow using firebase . I have deployed below cloud functions **signInWithPhoneAndPassword** but i have a problem , how do i check password against entered password as i had signed up using firebase phoneAuth with user to enter email and password. Would you like to guide me ? — xaif, Dec 01 '19 at 07:35

Dmytro Rostopira · Accepted Answer · 2019-06-27T14:47:17.073

Create cloud function with following code

const functions = require('firebase-functions');
const firebase = require('firebase');
const admin = require('firebase-admin');

admin.initializeApp();
firebase.initializeApp({
    //Add config for web-app here
    //Required because Admin SDK doesn't include signInWithEmailAndPassword method
});

exports.signInWithPhoneAndPassword = functions.https.onCall(async (data, context) => {
    const phoneNumber = data.phone;
    if (phoneNumber === undefined) {
        return {'s':400,'m':'Bad argument: no phone number'};
    }
    const user = await admin.auth().getUserByPhoneNumber(phoneNumber);
    const pass = data.password;
    try {
        await firebase.auth().signInWithEmailAndPassword(user.email, pass);
    } catch (e) {
        return {'s':400,'m':'Wrong password'};
    }
    const token = await admin.auth().createCustomToken(user.uid, {'devClaim':true}); //developer claims, optional param
    return {'s':200,'t':token};
});

On client side call this function, and if it returns object with "s"==200 use token with signInWithCustomToken (Calling a Cloud Function from Android through Firebase)

I like the fact that you addressed the potential security issue. — Taslim Oseni, Jun 27 '19 at 14:23

Taslim Oseni · Answer 2 · 2019-07-02T14:22:21.337

Currently, this feature does not exist.

However, there are ways you can improvise and still achieve this. Here's my suggestion:

First, when a user creates an account, you need to create a separate list on your db solely for mapping emails to phone numbers. Your db might look like this:

This way, you have a full list of emails and their linked phone numbers.

Now, at the login stage, do this:

When the user clicks the login button, check whether the user inputed an email or a phone number. You can use the Patterns class to perform this check:
If the user inputed an email, go ahead with the signInWithEmailAndPassword() approach.
If the user inputed a phone number, check the database of phone numbers in your FirebaseDatabase list and get the email from there. After getting the email, perform signInWithEmailAndPassword() and pass the email you got as well as the password the user inputed.

The downside to using this method is that it incurs an extra call (to get email from phone number) but at least, this should work.

I really hope this helps, merry coding!!

The REAL downside of this method, that unauthenticated user (read **anyone**) can read all users phone numbers and emails — Dmytro Rostopira, Jun 27 '19 at 14:04

score 1 · Answer 3 · answered Jul 02 '19 at 05:29

Firebase phone authentication is using OTP. This way there is no need to remember the password for a user. Once authenticated, you will be registered. The OTP code acts as a password. Still, if you want to customize the authentication method, firebase provide to customize authentication method https://firebase.google.com/docs/auth/android/custom-auth

Phone Number with Password Authentication using Firebase

3 Answers3

Related