-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Passwordless authentication #6152
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
A PR was opened for this but wasn’t finished. Would you like to take it over and create a new PR.? |
You can make using cloud code basically, Call this cloud function after got the phone nomber from user
Firstly get the sms code in your client from cloud function and check this code if right call this function
Maybe its not safe but if you don't have any choice you can use.. |
Why this is insecure when you verify the phone number previously ? |
@ChinaeduPascal This is not safe because hackers can directly bypass your phone (and therefore, the entire OTP verification loop) and call the cloud functions straight. If you have many users, likely you are using a generic password that applies to all the users in your platform. Therefore, if someone knows that password, they can access all the user accounts. If it passwords are unique, hackers can directly spam your server to test those passwords |
Hi There,
How do I implement passwordless authentication? Like sending OTP to phone number and verifying the code after.
The text was updated successfully, but these errors were encountered: