Authentification par numéro de téléphone

Phone number authentication allows users to sign in to your app using their mobile phone number. It's a secure and convenient method, especially for users who prefer not to create traditional email/password accounts or use social logins.

• Accessibility: Many users find it easy to use.
• Security: Leverages SMS for verification, adding a layer of security.
• No Passwords: Reduces password fatigue and forgotten password issues.

Before you can use phone number authentication in your app, you need to enable it in your Firebase project settings.

1. Go to the Firebase Console.
2. Navigate to Authentication > Sign-in method.
3. Enable the Phone provider.
4. Optionally, specify which phone numbers are allowed for testing.

This step tells Firebase that your project will support phone sign-ins.

To use phone authentication, your client-side application needs to be set up correctly. This often involves specific mechanisms to verify the user isn't a bot.

• Web: You'll need to use a RecaptchaVerifier to protect against abuse.
• Android: Firebase uses SafetyNet for device verification.
• iOS: Firebase uses DeviceCheck for device verification.

These checks ensure that the phone number verification requests are coming from legitimate app instances.

The phone number authentication process typically follows these steps:

1. The user enters their phone number into your app.
2. Your app requests Firebase to send a verification code via SMS to that number.
3. Firebase sends the SMS and returns a confirmationResult object to your app.
4. The user receives the SMS and enters the code into your app.
5. Your app uses the confirmationResult and the SMS code to sign the user in.

Let's see how to implement this.

On the web, you'll use firebase.auth().signInWithPhoneNumber(). It requires a phone number and a RecaptchaVerifier instance. The confirmationResult is crucial for the next step.

For web applications, Firebase Phone Auth requires reCAPTCHA verification to prevent abuse, like automated bots attempting to send SMS messages.

• You need an HTML element (e.g., a div) with a specific ID (like 'recaptcha-container') where reCAPTCHA can render, even if it's invisible.
• The RecaptchaVerifier handles the challenge. Once solved, the callback is triggered, allowing signInWithPhoneNumber to proceed.

It's an important security measure for web clients.

Once the user receives the SMS code and enters it, you use the confirmationResult object (saved from the previous step) to verify the code and complete the sign-in.

After a successful phone number sign-in, the user's information is available through the firebase.auth().currentUser object, just like any other authentication method.

• You can access their uid, phoneNumber, and other profile details.
• Use the onAuthStateChanged listener to monitor the user's login state across your application.

This allows you to personalize content and manage user sessions.

It's important to anticipate and handle errors gracefully to provide a good user experience. Some common errors with phone authentication include:

• auth/invalid-phone-number: The provided phone number is not valid.
• auth/missing-verification-code: The user didn't enter a code or it was empty.
• auth/invalid-verification-code: The entered SMS code is incorrect.
• auth/captcha-check-failed: reCAPTCHA verification failed (web).
• auth/too-many-requests: Too many verification attempts from the same device/IP.

Always display user-friendly messages for these errors.

You've learned how to implement phone number authentication with Firebase!

• Enable the provider in the Firebase Console.
• Set up client-side checks (reCAPTCHA for web).
• Initiate verification with signInWithPhoneNumber().
• Confirm the SMS code using the confirmationResult.
• Handle various error scenarios gracefully.

Phone auth offers a great balance of security and convenience for your users. Practice implementing it in your projects!