Phone number authentication in Firebase - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is phone number authentication in Firebase?

Phone number authentication is a method that lets users sign in to an app using their phone number. Firebase sends a code via SMS to verify the user’s identity.

beginner

Why is phone number authentication useful?

It allows users to sign in without remembering passwords. It uses something they have (their phone) to verify identity, making it simple and secure.

beginner

What is the role of the verification code in phone number authentication?

The verification code is sent by Firebase via SMS to the user’s phone. The user enters this code in the app to prove they own the phone number.

intermediate

What is reCAPTCHA in Firebase phone authentication?

reCAPTCHA helps prevent abuse by bots. Firebase uses it silently or visibly to make sure the phone number verification is done by a real person.

intermediate

What happens if the verification SMS is not received?

Firebase allows resending the code after a short wait. Users can also use the auto-retrieval feature on supported devices to verify automatically.

What does Firebase send to verify a phone number?

A A push notification

B An email with a link

C A phone call with a password

D A verification code via SMS

Firebase sends a verification code via SMS to confirm the phone number.

What is the main purpose of reCAPTCHA in phone authentication?

A To prevent automated abuse by bots

B To verify the phone number format

C To send the SMS faster

D To store user data securely

reCAPTCHA helps prevent abuse by ensuring a real person is verifying the phone number.

Which of these is NOT a step in Firebase phone authentication?

A Firebase sends verification code

B User enters password

C User enters phone number

D User enters verification code

Phone authentication does not require a password; it uses a verification code instead.

What can a user do if they don’t receive the verification SMS?

A Wait and request to resend the code

B Change their email address

C Restart the app without entering phone number

D Use a password instead

Users can wait and request Firebase to resend the verification code.

What does Firebase use to automatically verify the code on some devices?

A Manual code entry only

B Email confirmation

C Auto-retrieval feature

D Voice call verification

Firebase can automatically detect the verification code on supported devices using auto-retrieval.

Explain how Firebase phone number authentication works from start to finish.

Think about the steps a user takes and what Firebase does behind the scenes.

Describe the security measures Firebase uses to protect phone number authentication.

Consider how Firebase ensures only real users can verify their phone numbers.

Practice

1. What is the main purpose of phone number authentication in Firebase?

easy

A. To sign in users using SMS codes without passwords

B. To store phone numbers in the database

C. To send marketing messages to users

D. To verify email addresses

Solution

1. Step 1: Understand and identify the main purpose of phone number authentication

   It allows users to sign in by receiving a code on their phone via SMS instead of using a password. The main goal is to authenticate users securely and easily using their phone number and SMS code.

2. Final Answer:

   To sign in users using SMS codes without passwords -> Option A

3. Quick Check:

   Phone number authentication = SMS sign-in [OK]

Hint: Phone auth uses SMS codes to sign in, not emails [OK]

Common Mistakes:

• Confusing phone auth with email verification
• Thinking it stores phone numbers only
• Assuming it sends marketing SMS

2. Which Firebase method is used to start phone number authentication by sending an SMS code?

easy

A. signInWithEmailAndPassword()

B. signInWithPhoneNumber()

C. sendPasswordResetEmail()

D. verifyPhoneNumber()

Solution

1. Step 1: Identify the method for phone auth SMS sending and exclude unrelated methods

   Firebase provides signInWithPhoneNumber() to send the SMS code to the user. signInWithEmailAndPassword() is for email login, sendPasswordResetEmail() is for password reset, and verifyPhoneNumber() is not a Firebase client method.

2. Final Answer:

   signInWithPhoneNumber() -> Option B

3. Quick Check:

   Send SMS code = signInWithPhoneNumber() [OK]

Hint: Phone auth starts with signInWithPhoneNumber() [OK]

Common Mistakes:

• Using email sign-in methods for phone auth
• Confusing password reset with phone auth
• Assuming verifyPhoneNumber() is a Firebase method

3. What will happen if you try to sign in with phone number authentication without setting up reCAPTCHA verifier in Firebase web?

medium

A. The phone number will be stored but no SMS sent

B. The SMS code will be sent without any issues

C. The user will be signed in automatically

D. Firebase will throw an error requiring reCAPTCHA verification

Solution

1. Step 1: Understand reCAPTCHA role and predict behavior without it in Firebase phone auth

   Firebase requires reCAPTCHA on web to prevent abuse and verify the user is human before sending SMS. If reCAPTCHA is not set up, Firebase will block the SMS sending and throw an error demanding reCAPTCHA verification.

2. Final Answer:

   Firebase will throw an error requiring reCAPTCHA verification -> Option D

3. Quick Check:

   Missing reCAPTCHA = error thrown [OK]

Hint: Web phone auth needs reCAPTCHA or it errors [OK]

Common Mistakes:

• Assuming SMS sends without reCAPTCHA
• Thinking user signs in automatically
• Believing phone number stores without SMS

4. Given this code snippet, what is the error?

const confirmationResult = await signInWithPhoneNumber(auth, phoneNumber, appVerifier);
const userCredential = await confirmationResult.confirm(code);

medium

A. phoneNumber should be an email string

B. Using confirm() instead of verify() method

C. Missing reCAPTCHA verifier initialization

D. code variable should be a number, not string

Solution

1. Step 1: Check parameters and identify common mistake in signInWithPhoneNumber code

   The third parameter must be a valid reCAPTCHA verifier instance (appVerifier) initialized properly. If appVerifier is not initialized or missing, the code will fail even if confirm() is called correctly.

2. Final Answer:

   Missing reCAPTCHA verifier initialization -> Option C

3. Quick Check:

   Missing appVerifier init = error [OK]

Hint: Always initialize reCAPTCHA verifier before signInWithPhoneNumber() [OK]

Common Mistakes:

• Confusing confirm() with verify() method
• Passing email instead of phone number
• Assuming code must be number type

5. You want to implement phone number authentication in a React app using Firebase. Which sequence correctly describes the steps to sign in a user?

hard

A. Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user

B. Call signInWithPhoneNumber() -> confirm code -> initialize reCAPTCHA verifier -> sign in user

C. Confirm code -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> sign in user

D. Sign in user -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> confirm code

Solution

1. Step 1: Outline the correct sequence for implementing phone auth

   Initialize reCAPTCHA verifier first to prevent abuse and required before sending SMS. Call signInWithPhoneNumber() next to send the code to the user's phone. Confirm the code received by user using confirmationResult.confirm(code) to verify and sign in the user.

2. Final Answer:

   Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user -> Option A

3. Quick Check:

   reCAPTCHA -> send SMS -> confirm code = correct flow [OK]

Hint: Always start with reCAPTCHA, then send SMS, then confirm code [OK]

Common Mistakes:

• Calling signInWithPhoneNumber before reCAPTCHA setup
• Confirming code before SMS sent
• Trying to sign in before confirmation