Phone number authentication in Firebase - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after a successful phone number verification in Firebase?

After a user enters their phone number and completes the verification code step successfully, what is the immediate result in Firebase Authentication?

A The user must manually refresh the app to complete sign-in.

B The phone number is stored but the user remains unauthenticated until email verification.

C The user is signed in and a Firebase user ID token is generated.

D The verification code is saved for future logins but no user session is created.

💡 Hint

Think about what Firebase Authentication does immediately after verifying the phone number.

Firebase signs in the user automatically after successful phone number verification and generates a user ID token for session management.

❓ security

intermediate

Which Firebase feature helps prevent abuse of phone number authentication?

To avoid attackers abusing phone number authentication by sending many verification codes, which Firebase feature should be enabled?

A reCAPTCHA verification during phone number sign-in.

B Disabling multi-factor authentication.

C Using anonymous authentication only.

D Enabling email link sign-in instead.

💡 Hint

Think about how Firebase confirms the user is a real person before sending SMS codes.

Firebase uses reCAPTCHA to verify the user is human and prevent automated abuse of phone number authentication.

❓ Configuration

advanced

What is the correct way to configure Firebase phone authentication in a web app?

Which code snippet correctly initializes Firebase phone authentication with reCAPTCHA verifier?

A

const recaptchaVerifier = new firebase.auth.EmailAuthProvider('recaptcha-container');
const phoneProvider = new firebase.auth.PhoneAuthProvider();

B

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier();
const phoneProvider = new firebase.auth.EmailAuthProvider();

C

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container');
const phoneProvider = new firebase.auth.PhoneAuthProvider();

D

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container', {size: 'invisible'});
const phoneProvider = new firebase.auth.PhoneAuthProvider();

💡 Hint

Look for the correct constructor usage and options for invisible reCAPTCHA.

The RecaptchaVerifier requires the container ID and optional config like size. PhoneAuthProvider is used for phone authentication.

❓ Architecture

advanced

How should you architect a system to securely verify phone numbers with Firebase in a mobile app?

Which architecture best ensures secure phone number verification and user session management in a mobile app using Firebase?

A Use backend to generate custom tokens without verifying phone numbers, client signs in with those tokens.

B Use Firebase SDK on the client to send verification SMS and sign in users directly, with backend verifying ID tokens for protected resources.

C Send phone numbers to backend server, which sends SMS via Firebase Admin SDK, then client signs in anonymously.

D Use third-party SMS service for verification, then create Firebase users manually without client involvement.

💡 Hint

Consider where verification and sign-in happen and how backend trusts the client.

Firebase SDK handles SMS verification and sign-in securely on client. Backend trusts Firebase ID tokens to authorize users.

✅ Best Practice

expert

What is the recommended approach to handle phone number authentication failures in Firebase to improve user experience?

When a user fails phone number verification multiple times, what is the best practice to handle this situation?

A Implement exponential backoff with increasing delay before allowing retry and show clear error messages.

B Immediately block the user permanently after 3 failed attempts without explanation.

C Automatically switch to email authentication without user consent.

D Ignore failures and allow unlimited retries to avoid blocking users.

💡 Hint

Think about balancing security and user friendliness when handling failures.

Exponential backoff prevents abuse while informing users clearly improves experience and reduces frustration.

Practice

1. What is the main purpose of phone number authentication in Firebase?

easy

A. To sign in users using SMS codes without passwords

B. To store phone numbers in the database

C. To send marketing messages to users

D. To verify email addresses

Solution

1. Step 1: Understand and identify the main purpose of phone number authentication

   It allows users to sign in by receiving a code on their phone via SMS instead of using a password. The main goal is to authenticate users securely and easily using their phone number and SMS code.

2. Final Answer:

   To sign in users using SMS codes without passwords -> Option A

3. Quick Check:

   Phone number authentication = SMS sign-in [OK]

Hint: Phone auth uses SMS codes to sign in, not emails [OK]

Common Mistakes:

• Confusing phone auth with email verification
• Thinking it stores phone numbers only
• Assuming it sends marketing SMS

2. Which Firebase method is used to start phone number authentication by sending an SMS code?

easy

A. signInWithEmailAndPassword()

B. signInWithPhoneNumber()

C. sendPasswordResetEmail()

D. verifyPhoneNumber()

Solution

1. Step 1: Identify the method for phone auth SMS sending and exclude unrelated methods

   Firebase provides signInWithPhoneNumber() to send the SMS code to the user. signInWithEmailAndPassword() is for email login, sendPasswordResetEmail() is for password reset, and verifyPhoneNumber() is not a Firebase client method.

2. Final Answer:

   signInWithPhoneNumber() -> Option B

3. Quick Check:

   Send SMS code = signInWithPhoneNumber() [OK]

Hint: Phone auth starts with signInWithPhoneNumber() [OK]

Common Mistakes:

• Using email sign-in methods for phone auth
• Confusing password reset with phone auth
• Assuming verifyPhoneNumber() is a Firebase method

3. What will happen if you try to sign in with phone number authentication without setting up reCAPTCHA verifier in Firebase web?

medium

A. The phone number will be stored but no SMS sent

B. The SMS code will be sent without any issues

C. The user will be signed in automatically

D. Firebase will throw an error requiring reCAPTCHA verification

Solution

1. Step 1: Understand reCAPTCHA role and predict behavior without it in Firebase phone auth

   Firebase requires reCAPTCHA on web to prevent abuse and verify the user is human before sending SMS. If reCAPTCHA is not set up, Firebase will block the SMS sending and throw an error demanding reCAPTCHA verification.

2. Final Answer:

   Firebase will throw an error requiring reCAPTCHA verification -> Option D

3. Quick Check:

   Missing reCAPTCHA = error thrown [OK]

Hint: Web phone auth needs reCAPTCHA or it errors [OK]

Common Mistakes:

• Assuming SMS sends without reCAPTCHA
• Thinking user signs in automatically
• Believing phone number stores without SMS

4. Given this code snippet, what is the error?

const confirmationResult = await signInWithPhoneNumber(auth, phoneNumber, appVerifier);
const userCredential = await confirmationResult.confirm(code);

medium

A. phoneNumber should be an email string

B. Using confirm() instead of verify() method

C. Missing reCAPTCHA verifier initialization

D. code variable should be a number, not string

Solution

1. Step 1: Check parameters and identify common mistake in signInWithPhoneNumber code

   The third parameter must be a valid reCAPTCHA verifier instance (appVerifier) initialized properly. If appVerifier is not initialized or missing, the code will fail even if confirm() is called correctly.

2. Final Answer:

   Missing reCAPTCHA verifier initialization -> Option C

3. Quick Check:

   Missing appVerifier init = error [OK]

Hint: Always initialize reCAPTCHA verifier before signInWithPhoneNumber() [OK]

Common Mistakes:

• Confusing confirm() with verify() method
• Passing email instead of phone number
• Assuming code must be number type

5. You want to implement phone number authentication in a React app using Firebase. Which sequence correctly describes the steps to sign in a user?

hard

A. Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user

B. Call signInWithPhoneNumber() -> confirm code -> initialize reCAPTCHA verifier -> sign in user

C. Confirm code -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> sign in user

D. Sign in user -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> confirm code

Solution

1. Step 1: Outline the correct sequence for implementing phone auth

   Initialize reCAPTCHA verifier first to prevent abuse and required before sending SMS. Call signInWithPhoneNumber() next to send the code to the user's phone. Confirm the code received by user using confirmationResult.confirm(code) to verify and sign in the user.

2. Final Answer:

   Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user -> Option A

3. Quick Check:

   reCAPTCHA -> send SMS -> confirm code = correct flow [OK]

Hint: Always start with reCAPTCHA, then send SMS, then confirm code [OK]

Common Mistakes:

• Calling signInWithPhoneNumber before reCAPTCHA setup
• Confirming code before SMS sent
• Trying to sign in before confirmation