I am new to app development but wanted to start with flutter and appwrite. I want to build an app with Appwrite and Flutter. This app should have a restricted area were only registered users should have access.
I want to use a modified email/password authentication, with a phone number instead of the email.
I know how I can create a user with a phone number and confirm this number using the send secret. But I could not find anythig to get a session with only phone number and password.
Is my desired behavoir even possible with appwrite or am I just missing something?
Thank you in advance for your help!
Unfortunately, phone and password authentication is not supported. You can hack a workaround for this by using the email and password where the email is <phone number>#fakedomain.com.
What's your reason for not using Appwrite's Phone Auth system?
Related
I have the "happy path" of signing up a user implemented using Flutter & AWS Amplify. I have made the user to verify their account using their phone numbers so that the verification code is sent to the phone and the signup process is completed.
I realised that, during testing, one could easily make a mistake. So I want the user to be able to go back and change the phone number so that the verification code is sent to the correct one. However, using Amplify, you cannot change the details if the user is not signed in, and the user cannot be signed in unless their account is "confirmed". Of course, their account cannot be "confirmed" if they don't receive the verification code and with the wrong phone number due to their mistake, they will never receive the verification code...
Has anyone faced the same problem and could help me how to solve this please?
I read that you could use Lambda functions to "auto-confirm" the account without any verification which means they can sign in, which would allow me to change their phone number if they have entered a wrong phone number. But I am not sure if this is the easiest way to do it
How to implement phone number verification in Flutter. In my app user is signed in via email, after the sign in process i need to add the phone number and verify it via OTP. I tried in Firebase the phone number verification is added with the authentication flow.
I don’t want to include the authentication flow, i just need to verify the number. How to implement this?
Please someone help me on this.
It is not possible to implement phone number verification without using Firebase Authentication as phone number verification is a feature within the Firebase Authentication system.
In case a user forgot their password, how can I send them an email to reset it without firebase authentication?
As in they receive an email with a link that takes them to a page/webpage where they can reset their password and confirm the change, then they can login with their new password.
Assuming you are using Firebase Auth in your app: I don't know what you mean by "without firebase authentication?" That's not possible, but perhaps you mean through a specific means. Here are the two most common ways:
You can manually send a password reset by going into your firebase dashboard, go to Authentication, find the email, and on the right of the UID a menu icon comes up when you hover..you can choose to send a password reset email.
You can call this in a flutter app FirebaseAuth.instance.sendPasswordResetEmail(email: email);
How do I reset user password in app without sending email link using firebase in flutter?
If you've already established the user's identity by signing them in, you can update their password
Letting a user change the password of an account that they're not signed in to, would be a pretty big security risk though.
If you have another flow for password reset in mind, you can always update the password of any account through the Admin SDK, which can be used on trusted environments such as your development machine, a server that you control, or Cloud Functions/Cloud Run.
I currently creating a flutter app with sign up feature and I want to avoid spamming account so I setted up a phone verification to send a code by sms and fill it into the app when signing up (through twilio api). But I want to check before sending the sms if the phone number is already registred in my firestore collection(auth == null). I heard about firebase rules but I don't really know how to build it to be security compliant. I tried to use linkWithCredential but didn't seem to work. If anyone would have any advices for me ?
Thank you :)
You can write a cloud function to check your database if the phone number exists and return the result to the client.
You can login anonymously in order to have an access to the firebase database.
Also, you can provide custom rules for each collection, so for example, your collection can have free access if you want, but don't do it, use anonymously login instead.