【问题标题】:Firebase SMS Verification / AuthenticationFirebase 短信验证/身份验证
【发布时间】:2016-08-10 05:44:02
【问题描述】:

对于一个客户项目,我正在创建一个简单的混合应用程序,它提供非常简单的功能,但流量却很高。该应用程序通常不需要后端,因为它非常简单,而且 firebase 似乎是该项目的完美解决方案。

我唯一遇到的问题是使用 Firebase 进行短信验证/身份验证。然而,经过一番激烈的谷歌搜索和文档阅读后,我开始意识到没有简单的方法可以做到这一点。到目前为止,这是我所研究的:

  1. Fabric.io Digits 有一个很棒的 JS API,但是由于某种原因,firebase 和数字不能很好地结合在一起:https://groups.google.com/forum/#!topic/firebase-talk/sB7lPuyCVBQ
  2. Facebook Account Kit - 就在一周前,Facebook 发布了一个用于 SMS 验证和身份验证的新工具包,尽管它仍然感觉它与 fabric.io 数字有同样的问题,至少在没有被证明之前是这样。
  3. 通过 NodeJS 的 Twilio / Nexmo - 这些都是具有出色 JS API 的史诗服务,但据我了解,这需要单独的后端服务器来处理 JWT 令牌交换。而这本身就是另一台服务器,这将成为高流量期间的瓶颈,也是另一个安全漏洞点,客户端团队必须单独管理。不是最愉快的。
  4. Twilio / Nexmo 和 Auth0 - 到目前为止,这似乎是最佳选择,其中身份验证和用户管理由 Auth0 处理,但是鉴于 twilio 或 nexmo 和 auth0 都是付费解决方案,这种解决方案很快就会变得昂贵。并不是说我是一个期待免费工作的小气鬼——但感觉就像一个非常昂贵的额外步骤,因为它只是转发代币。 [参见:来自地狱的客户]
  5. 我记得在某处读到过一个建议,例如在 firebase 上使用电话号码作为电子邮件,例如:123-456-7890@example.com 并使用通过短信发送的安全码作为密码,由于许多不同的原因,这听起来很粗略。

通常对于混合移动应用程序,它们的非本地特性或 JS API 是罪魁祸首,但第一次(至少对我而言)感觉并非如此。我认为此时 Firebase 不是一个有效的选择,但在开始研究 AWS 并为客户设置整个后端之前,我想最后一次询问社区中充满爱心和关怀的成员。

除了中间服务/没有后端服务器,还有其他方法可以处理这种类型的身份验证吗?有人有使用这些解决方案的经验吗?


更新:2017 年 5 月

Phone Verification & Authentication is now natively available in Firebase.见下面我的自贴答案。


更新:2017 年 4 月

Firebase 现在原生支持 Cloud Functions。现在,您无需设置任何服务器即可使用 Cloud Functions 完成此任务以及更多其他任务。


更新:2017 年 10 月

Fabric.io 和 Firebase 合作并集成了 Digits in Firebase phone authentication,并为 Fabric 推出了更多功能。

【问题讨论】:

  • Google 不久前收购了 Digits。昨天,他们宣布从 Digits 迁移到 Firebase 身份验证包括 SMS 验证。我相信 9 月之后将无法获得数字。登录屏幕由开发人员设计,不是由 API 提供(与 Digits 不同)。
  • 一旦可用,我会很高兴地指出这个答案。真是令人振奋的消息。
  • 现在可用,可用于生产。我刚刚完成了我的第一次测试。
  • 我的立场是正确的!高兴的头脑清醒。马上更新!
  • Aand 更新,请随时点赞/推广,希望更多人看到它。

标签: authentication firebase twilio twitter-fabric nexmo


【解决方案1】:

我不能谈论你提到的每一个集成,但你可能想尝试另一个 Twilio 的服务,Authy。

我们最近通过教程发布了可用于生产的代码示例,以帮助人们解决这类问题。

一个这样的例子将引导您完成:

  • 向移动 Authy 应用发送 OneTouch 推送通知 或
  • 通过移动 Authy 应用发送令牌或
  • 在通过 Authy 发送的短信中发送一次性令牌 Twilio。

2FA with Authy tutorial。以下 Node.js sn-p 显示了等待用户状态被批准或拒绝的端点。如果用户批准了 OneTouch 请求,我们会将他们的会话保存为confirmed,这样他们就可以正式登录了。

如果请求被拒绝,我们会呈现/verify 页面并要求用户使用令牌登录。

// Internal endpoint for checking the status of OneTouch
exports.authyStatus = function(request, response) {
    var status = (request.user) ? request.user.authyStatus : 'unverified';
    if (status == 'approved') {
        request.session.confirmed = true;
        request.session.save(function(err) {
            if (err) return error(response, 500, 
                'There was an error validating your session.');
        });
    }
    if (!request.session) {
        return error(response, 404, 'No valid session found for this user.');
    } else {
        response.send({ status: status });
    }   
};

所以,这确实需要您拥有一台服务器。但是,如果试一试示例,这应该可以帮助您确定最适合您的应用的方法。

【讨论】:

  • 非常感谢梅根!这启发了一个很好的方法来解决问题,更好地理解这个概念,我将实施一个基于 Authy 的解决方案。
  • 很高兴听到它有帮助!
  • @canozbay with Authy 你没有为firebase生成自定义令牌吗?
  • @jasan 最初的目标是没有有服务器而只使用firebase。我认为这可以通过 Twitter (fabric.io) 数字或 Facebook Account Kit 实现。后来我意识到 firebase 没有与这些服务直接集成。 Megan 的回答给了我一个想法,所以现在我没有使用整个服务器来处理扩展和正常运行时间问题,而是使用 Amazon Lambda + Authy 为 firebase 生成令牌。
  • @SDude 我们使用了 createCustomToken().. 我们的项目是为了广告和我们的一位客户,所以我们不能要求电子邮件/通行证。这是一个非常具体的用例。所以我们发行了自己的代币。 Lambda 会将令牌返回给客户端应用程序,然后客户端应用程序将使用这些令牌登录到 Firebase。在那之后,firebase 无论如何都会处理令牌。因此,对我们来说,Lambda 只需要作为初始注册的中间人使用电话号码,因为没有更好的词。
【解决方案2】:

截至 2017 年 5 月 17 日,Firebase 的优秀员工已将 Digits 的电话身份验证功能融入 Firebase。 This is now incredibly easy to achieve natively within Firebase,或多或少只需轻轻一按,无需外部服务或类似服务。 You can read more about it in the docs :)

【讨论】:

  • 这个价格是多少?
  • @cprcrack 据我所知,电话验证是免费的。有关所有其他一般 Firebase 定价信息,您可以查看:firebase.google.com/pricing
  • @cprcrack 我已经更正了,不幸的是它不是免费的。 Firebase 的定价页面有最新的。截至 2017 年 5 月 24 日,美国、加拿大或印度为 1000 次验证 = 10 美元。 1000 次验证 = 60 美元,适用于所有其他国家/地区。
  • 它还说每月前 10k 验证是免费的。
  • 为什么firebase价格贵?免费的限制只有10K?为什么不 100K 喜欢 facebook 帐户工具包?为什么谷歌为什么?
【解决方案3】:

现在可以在 firebase 中使用电话身份验证。这是使用 Firebase 进行电话身份验证的代码:

EditText phoneNum,Code;// two edit text one for enter phone number other for enter OTP code
Button sent_,Verify;// sent button to request for verification and verify is for to verify code
private PhoneAuthProvider.ForceResendingToken mResendToken;
private PhoneAuthProvider.OnVerificationStateChangedCallbacks mCallbacks;
private FirebaseAuth mAuth;
private String mVerificationId;

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_phone_number_auth);

    phoneNum =(EditText) findViewById(R.id.fn_num);
    Code =(EditText) findViewById(R.id.code);

    sent_ =(Button)findViewById(R.id.sent_nu);
    Verify =(Button)findViewById(R.id.verify);

    callback_verificvation();               ///function initialization

    mAuth = FirebaseAuth.getInstance();
    sent_.setOnClickListener(new View.OnClickListener() {
        @Override
        public void onClick(View v) {
            String num=phoneNum.getText().toString();
            startPhoneNumberVerification(num);          // call function for receive OTP 6 digit code
        }
    });
    Verify.setOnClickListener(new View.OnClickListener() {
        @Override
        public void onClick(View v) {
            String code=Code.getText().toString();
            verifyPhoneNumberWithCode(mVerificationId,code);            //call function for verify code 

        }
    });
}

private void startPhoneNumberVerification(String phoneNumber) {
    // [START start_phone_auth]
    PhoneAuthProvider.getInstance().verifyPhoneNumber(
            phoneNumber,        // Phone number to verify
            60,                 // Timeout duration
            TimeUnit.SECONDS,   // Unit of timeout
            this,               // Activity (for callback binding)
            mCallbacks);        // OnVerificationStateChangedCallbacks
    // [END start_phone_auth]


}

private void signInWithPhoneAuthCredential(PhoneAuthCredential credential) {
    mAuth.signInWithCredential(credential)
            .addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
                @Override
                public void onComplete(@NonNull Task<AuthResult> task) {
                    if (task.isSuccessful()) {
                        // Sign in success, update UI with the signed-in user's information

                        FirebaseUser user = task.getResult().getUser();
                        Toast.makeText(getApplicationContext(), "sign in successfull", Toast.LENGTH_SHORT).show();

                    } else {
                        // Sign in failed, display a message and update the UI

                        if (task.getException() instanceof FirebaseAuthInvalidCredentialsException) {
                            // The verification code entered was invalid

                        }


                    }
                }
            });
}
private void verifyPhoneNumberWithCode(String verificationId, String code) {
    // [START verify_with_code]
    PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, code);
    // [END verify_with_code]
    signInWithPhoneAuthCredential(credential);
}


private void callback_verificvation() {

    mCallbacks = new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {

        @Override
        public void onVerificationCompleted(PhoneAuthCredential credential) {
            // This callback will be invoked in two situations:
            // 1 - Instant verification. In some cases the phone number can be instantly
            //     verified without needing to send or enter a verification code.
            // 2 - Auto-retrieval. On some devices Google Play services can automatically
            //     detect the incoming verification SMS and perform verificaiton without
            //     user action.





            signInWithPhoneAuthCredential(credential);
        }

        @Override
        public void onVerificationFailed(FirebaseException e) {
            // This callback is invoked in an invalid request for verification is made,
            // for instance if the the phone number format is not valid.


            if (e instanceof FirebaseAuthInvalidCredentialsException) {
                // Invalid request

            } else if (e instanceof FirebaseTooManyRequestsException) {
                // The SMS quota for the project has been exceeded

            }

            // Show a message and update the UI

        }

        @Override
        public void onCodeSent(String verificationId,
                               PhoneAuthProvider.ForceResendingToken token) {
            // The SMS verification code has been sent to the provided phone number, we
            // now need to ask the user to enter the code and then construct a credential
            // by combining the code with a verification ID.


            // Save verification ID and resending token so we can use them later
            mVerificationId = verificationId;
            mResendToken = token;


        }
    };

【讨论】:

    【解决方案4】:
    import android.app.Activity;
    import android.os.Bundle;
    import android.support.annotation.NonNull;
    import android.text.TextUtils;
    import android.util.Log;
    import android.widget.EditText;
    import android.widget.Toast;
    
    import com.google.android.gms.tasks.OnCompleteListener;
    import com.google.android.gms.tasks.Task;
    import com.google.firebase.FirebaseException;
    import com.google.firebase.FirebaseTooManyRequestsException;
    import com.google.firebase.auth.AuthResult;
    import com.google.firebase.auth.FirebaseAuth;
    import com.google.firebase.auth.FirebaseAuthInvalidCredentialsException;
    import com.google.firebase.auth.FirebaseUser;
    import com.google.firebase.auth.PhoneAuthCredential;
    import com.google.firebase.auth.PhoneAuthProvider;
    
    import java.util.concurrent.TimeUnit;
    
    public class PhoneAutenticationService {
    public PhoneAutenticationService(Activity activity,FirebaseAuth auth) {
        this.activity = activity;
        this.mAuth = auth;
        setupCallback();
    }
    
    private static final String TAG = PhoneAutenticationService.class.getSimpleName();
    
    private Activity activity;
    private String verificationCode;
    private static final String KEY_VERIFY_IN_PROGRESS = "key_verify_in_progress";
    
    private static final int STATE_INITIALIZED = 1;
    private static final int STATE_CODE_SENT = 2;
    private static final int STATE_VERIFY_FAILED = 3;
    private static final int STATE_VERIFY_SUCCESS = 4;
    private static final int STATE_SIGNIN_FAILED = 5;
    private static final int STATE_SIGNIN_SUCCESS = 6;
    
    // [START declare_auth]
    private FirebaseAuth mAuth;
    // [END declare_auth]
    
    private boolean mVerificationInProgress = false;
    private String mVerificationId;
    private PhoneAuthProvider.OnVerificationStateChangedCallbacks mCallbacks;
    private PhoneAuthProvider.ForceResendingToken mResendToken;
    
    protected void onSaveInstanceState(Bundle outState) {
        outState.putBoolean(KEY_VERIFY_IN_PROGRESS, mVerificationInProgress);
    }
    
    protected void onRestoreInstanceState(Bundle savedInstanceState) {
        mVerificationInProgress = savedInstanceState.getBoolean(KEY_VERIFY_IN_PROGRESS);
    }
    
    
    // [START on_start_check_user]
    public void onStart(EditText mPhoneNumberField) {
        // Check if user is signed in (non-null) and update UI accordingly.
        FirebaseUser currentUser = mAuth.getCurrentUser();
        updateUI(currentUser);
        // [START_EXCLUDE]
        if (mVerificationInProgress && validatePhoneNumber(mPhoneNumberField)) {
            startPhoneNumberVerification(mPhoneNumberField.getText().toString());
        }
        // [END_EXCLUDE]
    }
    // [END on_start_check_user]
    
    private void setupCallback(){
        mCallbacks = new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {
    
            @Override
            public void onVerificationCompleted(PhoneAuthCredential credential) {
                // This callback will be invoked in two situations:
                // 1 - Instant verification. In some cases the phone number can be instantly
                //     verified without needing to send or enter a verification code.
                // 2 - Auto-retrieval. On some devices Google Play services can automatically
                //     detect the incoming verification SMS and perform verificaiton without
                //     user action.
                Log.d(TAG, "onVerificationCompleted:" + credential);
                // [START_EXCLUDE silent]
                mVerificationInProgress = false;
                // [END_EXCLUDE]
    
                // [START_EXCLUDE silent]
                // Update the UI and attempt sign in with the phone credential
                updateUI(STATE_VERIFY_SUCCESS, credential);
                // [END_EXCLUDE]
                signInWithPhoneAuthCredential(credential);
            }
    
            @Override
            public void onVerificationFailed(FirebaseException e) {
                // This callback is invoked in an invalid request for verification is made,
                // for instance if the the phone number format is not valid.
                Log.w(TAG, "onVerificationFailed", e);
                // [START_EXCLUDE silent]
                mVerificationInProgress = false;
                // [END_EXCLUDE]
    
                if (e instanceof FirebaseAuthInvalidCredentialsException) {
                    // Invalid request
                    // [START_EXCLUDE]
                    Toast.makeText(activity,"Invalid phone number.",Toast.LENGTH_SHORT).show();
                    // [END_EXCLUDE]
                } else if (e instanceof FirebaseTooManyRequestsException) {
                    // The SMS quota for the project has been exceeded
                    // [START_EXCLUDE]
                    Toast.makeText(activity,"Quota exceeded.",Toast.LENGTH_SHORT).show();
    
                    // [END_EXCLUDE]
                }
    
                // Show a message and update the UI
                // [START_EXCLUDE]
                updateUI(STATE_VERIFY_FAILED);
                // [END_EXCLUDE]
            }
    
            @Override
            public void onCodeSent(String verificationId,
                                   PhoneAuthProvider.ForceResendingToken token) {
                // The SMS verification code has been sent to the provided phone number, we
                // now need to ask the user to enter the code and then construct a credential
                // by combining the code with a verification ID.
                Log.d(TAG, "onCodeSent:" + verificationId);
                Toast.makeText(activity,"onCodeSent:" + verificationId,Toast.LENGTH_SHORT).show();
                verificationCode = verificationId;
                // Save verification ID and resending token so we can use them later
                mVerificationId = verificationId;
                setVerificationCode(verificationId);
                mResendToken = token;
    
                // [START_EXCLUDE]
                // Update UI
                updateUI(STATE_CODE_SENT);
                // [END_EXCLUDE]
            }
    
        };
    }
    
    
    public void startPhoneNumberVerification(String phoneNumber) {
        // [START start_phone_auth]
        PhoneAuthProvider.getInstance().verifyPhoneNumber(
                phoneNumber,        // Phone number to verify
                60,                 // Timeout duration
                TimeUnit.SECONDS,   // Unit of timeout
                activity,               // Activity (for callback binding)
                mCallbacks);        // OnVerificationStateChangedCallbacks
        // [END start_phone_auth]
    
        mVerificationInProgress = true;
    }
    
    
    
    public void verifyPhoneNumberWithCode(String verificationId, String code) {
        // [START verify_with_code]
        PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, code);
    
        // [END verify_with_code]
        signInWithPhoneAuthCredential(credential);
    }
    
    // [START resend_verification]
    public void resendVerificationCode(String phoneNumber,
                                       PhoneAuthProvider.ForceResendingToken token) {
        PhoneAuthProvider.getInstance().verifyPhoneNumber(
                phoneNumber,        // Phone number to verify
                60,                 // Timeout duration
                TimeUnit.SECONDS,   // Unit of timeout
                activity,               // Activity (for callback binding)
                mCallbacks);        // resending
        // [END start_phone_auth]
    }
    // [END resend_verification]
    
    // [START sign_in_with_phone]
    public void signInWithPhoneAuthCredential(PhoneAuthCredential credential) {
        mAuth.signInWithCredential(credential)
                .addOnCompleteListener(activity, new OnCompleteListener<AuthResult>() {
                    @Override
                    public void onComplete(@NonNull Task<AuthResult> task) {
                        if (task.isSuccessful()) {
                            // Sign in success, update UI with the signed-in user's information
                            Log.d(TAG, "signInWithCredential:success");
                            Toast.makeText(activity,"signInWithCredential:success",Toast.LENGTH_SHORT).show();
                            FirebaseUser user = task.getResult().getUser();
                            // [START_EXCLUDE]
                            updateUI(STATE_SIGNIN_SUCCESS, user);
                            // [END_EXCLUDE]
                        } else {
                            // Sign in failed, display a message and update the UI
                            Log.w(TAG, "signInWithCredential:failure", task.getException());
                            if (task.getException() instanceof FirebaseAuthInvalidCredentialsException) {
                                // The verification code entered was invalid
                                // [START_EXCLUDE silent]
                                Toast.makeText(activity,"Invalid code.",Toast.LENGTH_SHORT).show();
                                // [END_EXCLUDE]
                            }
                            // [START_EXCLUDE silent]
                            // Update UI
                            updateUI(STATE_SIGNIN_FAILED);
                            // [END_EXCLUDE]
                        }
                    }
                });
    }
    // [END sign_in_with_phone]
    
    
    public void signOut() {
        mAuth.signOut();
        updateUI(STATE_INITIALIZED);
    }
    
    private void updateUI(int uiState) {
        updateUI(uiState, mAuth.getCurrentUser(), null);
    }
    
    public void updateUI(FirebaseUser user) {
        if (user != null) {
            updateUI(STATE_SIGNIN_SUCCESS, user);
        } else {
            updateUI(STATE_INITIALIZED);
        }
    }
    
    private void updateUI(int uiState, FirebaseUser user) {
        updateUI(uiState, user, null);
    }
    
    private void updateUI(int uiState, PhoneAuthCredential cred) {
        updateUI(uiState, null, cred);
    }
    
    private void updateUI(int uiState, FirebaseUser user, PhoneAuthCredential cred) {
        switch (uiState) {
            case STATE_INITIALIZED:
                // Initialized state, show only the phone number field and start button
                Toast.makeText(activity,"Initialized state",Toast.LENGTH_SHORT).show();
                break;
            case STATE_CODE_SENT:
                // Code sent state, show the verification field, the
                Toast.makeText(activity,"Code sent state",Toast.LENGTH_SHORT).show();
    
                break;
            case STATE_VERIFY_FAILED:
                // Verification has failed, show all options
                Toast.makeText(activity,"Verification has failed",Toast.LENGTH_SHORT).show();
    
                break;
            case STATE_VERIFY_SUCCESS:
                // Verification has succeeded, proceed to firebase sign in
                Toast.makeText(activity,"Verification has succeeded",Toast.LENGTH_SHORT).show();
    
                // Set the verification text based on the credential
                if (cred != null) {
                    if (cred.getSmsCode() != null) {
                        //mVerificationField.setText(cred.getSmsCode());
                    } else {
                        Toast.makeText(activity,"Invalid verification code.",Toast.LENGTH_SHORT).show();
                    }
                }
    
                break;
            case STATE_SIGNIN_FAILED:
                // No-op, handled by sign-in check
                Toast.makeText(activity,"Sign in failed",Toast.LENGTH_SHORT).show();
    
                break;
            case STATE_SIGNIN_SUCCESS:
                // Np-op, handled by sign-in check
                Toast.makeText(activity,"Sign in sucesssss!!!!",Toast.LENGTH_SHORT).show();
                break;
        }
    
        if (user == null) {
            // Signed out
    
        } else {
            // Signed in
        }
    }
    
    
    public boolean validatePhoneNumber(EditText mPhoneNumberField) {
        String phoneNumber = mPhoneNumberField.getText().toString();
        if (TextUtils.isEmpty(phoneNumber) || phoneNumber.length()>10 || phoneNumber.length()<9) {
            Toast.makeText(activity,"Invalid phone number.",Toast.LENGTH_SHORT).show();
            return false;
        }
    
        return true;
    }
    
    public PhoneAuthProvider.OnVerificationStateChangedCallbacks getmCallbacks() {
        return mCallbacks;
    }
    
    public PhoneAuthProvider.ForceResendingToken getmResendToken() {
        return mResendToken;
    }
    
    public FirebaseAuth getmAuth() {
        return mAuth;
    }
    
    public String getVerificationCode() {
        return verificationCode;
    }
    
    public void setVerificationCode(String verificationCode) {
        this.verificationCode = verificationCode;
    }
    

    }

    在您的活动中初始化 Firebase 身份验证和侦听器

     mAuth = FirebaseAuth.getInstance();
        mAuthListener = new FirebaseAuth.AuthStateListener() {
            @Override
            public void onAuthStateChanged(@NonNull FirebaseAuth firebaseAuth) {
                FirebaseUser user = firebaseAuth.getCurrentUser();
                if (user != null) {
                    Log.d(TAG, "onAuthStateChanged:signed_in:" + user.getUid());
                } else {
                    Log.d(TAG, "onAuthStateChanged:signed_out");
                }
                // ...
            }
        };
    
    
        //init all auth process
        phoneAutenticationService = new PhoneAutenticationService(this,mAuth);
    
     @Override
    public void onStart() {
        super.onStart();
        mAuth.addAuthStateListener(mAuthListener);
        getActivity().registerReceiver(smsBroadcastReceiver, filter);// define e broadcast receiver to intercept a sms verification code
    }
    
    @Override
    public void onStop() {
        super.onStop();
        if (mAuthListener != null) {
            mAuth.removeAuthStateListener(mAuthListener);sms code
        }
        getActivity().unregisterReceiver(smsBroadcastReceiver);
    
    }
    

    最后调用firebase方法进行身份验证

    public void startAuthenticationByPhone(){
        if (!validatePhoneNumber(phoneInput)) {
            return;
        }
        startPhoneNumberVerification(phoneInput.getText().toString());
    
    }......
    

    【讨论】:

      猜你喜欢
      • 2016-07-27
      • 1970-01-01
      • 2018-06-01
      • 1970-01-01
      • 2021-01-21
      • 1970-01-01
      • 2020-04-01
      • 2022-12-10
      • 2022-06-28
      相关资源
      最近更新 更多