Skip to content

Passwordless authentication #6152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Eolykab opened this issue Oct 22, 2019 · 4 comments
Closed

Passwordless authentication #6152

Eolykab opened this issue Oct 22, 2019 · 4 comments
Labels
type:feature New feature or improvement of existing feature

Comments

@Eolykab
Copy link

Eolykab commented Oct 22, 2019

Hi There,

How do I implement passwordless authentication? Like sending OTP to phone number and verifying the code after.

@dplewis
Copy link
Member

dplewis commented Oct 23, 2019

A PR was opened for this but wasn’t finished.

#5306

Would you like to take it over and create a new PR.?

@memishood
Copy link

You can make using cloud code basically,

Call this cloud function after got the phone nomber from user

Parse.Cloud.define('SendSMS', (req, res) => {
	let code = Math.floor(1000 + Math.random() * 9000);
	let getMessage = code + ' This is your verification code';
	let phone = req.params.phone;
	let accountSid = 'XXX';
	let authToken = 'XXX';
	var client = require('twilio')(accountSid, authToken);
	client.messages.create({
		body: getMessage,
		from: '+yourTwilioPhoneNumber',
		to: phone
	}).then( result => {
		res.success(code);
	}).catch( error => {
		res.error(error);
	})
});

Firstly get the sms code in your client from cloud function and check this code if right call this function

Parse.Cloud.define('Auth', (req,res) => {
	var pass = Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
	var phone = req.params.phone;
	var query = new Parse.Query(Parse.User);
	query.equalTo('username', phone);
	query.first({useMasterKey: true}).then( user => {
		user.set('password', pass);
		user.save(null, {useMasterKey: true}).then( () => {
			Parse.User.logIn(phone, pass).then( token => {
				res.success(token.getSessionToken());
			});
		}).catch( error => {
			res.error(error);
		});
          // user couldn't find lets sign up!
	}).catch( () => {
		let user = new Parse.User();
		user.set('username', phone);
		user.set('password', pass);
		user.save(null, {useMasterKey: true}).then ( token => {
			res.success(token.getSessionToken());
		}).catch ( e => {
			res.error(e);
		});
	});
});

Maybe its not safe but if you don't have any choice you can use..

@ChinaeduPascal
Copy link

You can make using cloud code basically,

Call this cloud function after got the phone nomber from user

Parse.Cloud.define('SendSMS', (req, res) => {
	let code = Math.floor(1000 + Math.random() * 9000);
	let getMessage = code + ' This is your verification code';
	let phone = req.params.phone;
	let accountSid = 'XXX';
	let authToken = 'XXX';
	var client = require('twilio')(accountSid, authToken);
	client.messages.create({
		body: getMessage,
		from: '+yourTwilioPhoneNumber',
		to: phone
	}).then( result => {
		res.success(code);
	}).catch( error => {
		res.error(error);
	})
});

Firstly get the sms code in your client from cloud function and check this code if right call this function

Parse.Cloud.define('Auth', (req,res) => {
	var pass = Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
	var phone = req.params.phone;
	var query = new Parse.Query(Parse.User);
	query.equalTo('username', phone);
	query.first({useMasterKey: true}).then( user => {
		user.set('password', pass);
		user.save(null, {useMasterKey: true}).then( () => {
			Parse.User.logIn(phone, pass).then( token => {
				res.success(token.getSessionToken());
			});
		}).catch( error => {
			res.error(error);
		});
          // user couldn't find lets sign up!
	}).catch( () => {
		let user = new Parse.User();
		user.set('username', phone);
		user.set('password', pass);
		user.save(null, {useMasterKey: true}).then ( token => {
			res.success(token.getSessionToken());
		}).catch ( e => {
			res.error(e);
		});
	});
});

Maybe its not safe but if you don't have any choice you can use..

Why this is insecure when you verify the phone number previously ?

@noaker
Copy link

noaker commented Dec 16, 2021

@ChinaeduPascal This is not safe because hackers can directly bypass your phone (and therefore, the entire OTP verification loop) and call the cloud functions straight. If you have many users, likely you are using a generic password that applies to all the users in your platform. Therefore, if someone knows that password, they can access all the user accounts. If it passwords are unique, hackers can directly spam your server to test those passwords

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:feature New feature or improvement of existing feature
Projects
None yet
Development

No branches or pull requests

6 participants