Phone number authentication in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after a successful phone number verification in Firebase?

After a user enters their phone number and completes the verification code step successfully, what is the immediate result in Firebase Authentication?

A The user must manually refresh the app to complete sign-in.

B The phone number is stored but the user remains unauthenticated until email verification.

C The user is signed in and a Firebase user ID token is generated.

D The verification code is saved for future logins but no user session is created.

💡 Hint

Think about what Firebase Authentication does immediately after verifying the phone number.

Firebase signs in the user automatically after successful phone number verification and generates a user ID token for session management.

❓ security

intermediate

Which Firebase feature helps prevent abuse of phone number authentication?

To avoid attackers abusing phone number authentication by sending many verification codes, which Firebase feature should be enabled?

A reCAPTCHA verification during phone number sign-in.

B Disabling multi-factor authentication.

C Using anonymous authentication only.

D Enabling email link sign-in instead.

💡 Hint

Think about how Firebase confirms the user is a real person before sending SMS codes.

Firebase uses reCAPTCHA to verify the user is human and prevent automated abuse of phone number authentication.

❓ Configuration

advanced

What is the correct way to configure Firebase phone authentication in a web app?

Which code snippet correctly initializes Firebase phone authentication with reCAPTCHA verifier?

A

const recaptchaVerifier = new firebase.auth.EmailAuthProvider('recaptcha-container');
const phoneProvider = new firebase.auth.PhoneAuthProvider();

B

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier();
const phoneProvider = new firebase.auth.EmailAuthProvider();

C

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container');
const phoneProvider = new firebase.auth.PhoneAuthProvider();

D

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container', {size: 'invisible'});
const phoneProvider = new firebase.auth.PhoneAuthProvider();

💡 Hint

Look for the correct constructor usage and options for invisible reCAPTCHA.

The RecaptchaVerifier requires the container ID and optional config like size. PhoneAuthProvider is used for phone authentication.

❓ Architecture

advanced

How should you architect a system to securely verify phone numbers with Firebase in a mobile app?

Which architecture best ensures secure phone number verification and user session management in a mobile app using Firebase?

A Use backend to generate custom tokens without verifying phone numbers, client signs in with those tokens.

B Use Firebase SDK on the client to send verification SMS and sign in users directly, with backend verifying ID tokens for protected resources.

C Send phone numbers to backend server, which sends SMS via Firebase Admin SDK, then client signs in anonymously.

D Use third-party SMS service for verification, then create Firebase users manually without client involvement.

💡 Hint

Consider where verification and sign-in happen and how backend trusts the client.

Firebase SDK handles SMS verification and sign-in securely on client. Backend trusts Firebase ID tokens to authorize users.

✅ Best Practice

expert

What is the recommended approach to handle phone number authentication failures in Firebase to improve user experience?

When a user fails phone number verification multiple times, what is the best practice to handle this situation?

A Implement exponential backoff with increasing delay before allowing retry and show clear error messages.

B Immediately block the user permanently after 3 failed attempts without explanation.

C Automatically switch to email authentication without user consent.

D Ignore failures and allow unlimited retries to avoid blocking users.

💡 Hint

Think about balancing security and user friendliness when handling failures.

Exponential backoff prevents abuse while informing users clearly improves experience and reduces frustration.