How can I reauthenticate with phone number?

[nandorojo]

Hey there, thanks for a great library. Have a question here.

I'm using phone auth. Calling getIdTokenResult is giving this error to our users sometimes:

[auth/user-token-expired] The user's credential is no longer valid. The user must sign in again.

I didn't even know this was possible. I expected that with the refresh token, users would never get logged out or have a credential expire.

In any case, from some googling, I found that I need to "reauthenticate" the user using their credential.

Are there any notes for how to do this with phone number? Is the expectation that I sign them out? This can be a bit jarring as a UX if they're in the middle of something.

Perhaps I'm totally missing something, in which case, thank you to anyone who can provide some guidance!

Is there a way to just use the refresh token here?

[mikehardy]

Starting with this
https://rnfirebase.io/reference/auth#verifyPhoneNumber

then through this
https://rnfirebase.io/reference/auth/phoneauthlistener

finally using the credential with this
https://rnfirebase.io/reference/auth/user#reauthenticateWithCredential

As for why it expired there are a few reasons - usually to do with device time, one of the niftiest is discovering how many kids use their parent's phone and try to get around various controls by altering device time to some far future date. But basically "device time out of sync" so the one hour token life is deemed to be expired

As for why it did not refresh, there are some reasons - I don't recall the specifics (apologies) but there is an API in google cloud where if disabled no token refreshes succeed! Which is pretty frustrating

However, as a UX it can be jarring - that said I've seen it handled well as a user from time to time in other apps and it can come about when as a user you are using an app that allows multiple devices to be logged in at once but then as a user for security reasons you revoke the access on all devices from one device. Then on all the other devices this will happen. Facebook I think lets you log out of other sessions this way as does whatsapp IIRC. And all you can do is just popup on the user saying "Your login session has expired / you need to login again to continue working" etc

[nandorojo]

Thanks so much for the response. I'm not entirely aware of how I'm supposed to use verifyPhoneNumber together with the other functions.

Is the idea that I should make someone enter their phone again and add a code again? And then I set up a listener using verifyPhoneNumber after that? Or do I just show them the sign in with phone screen again and have them signInWithPhoneNumber?

Apologies for my lack of knowledge around this Firebase concept.

Again, really appreciate your fast response.

[mikehardy]

You have to do the full authentication flow again yes - ask for phone number (or if you have it available, pre-populate it etc) and call the API that begins verification by sending the SMS code, listen for the phone verify to auto-submit (android this is possible, iOS not) and/or have user enter the SMS code so phone verify is complete and you have a new valid phone crediential

Now sign in the user with that new credential

I believe there is sample code showing the phone number+code flow for a similar API, code is maybe adaptable https://rnfirebase.io/auth/phone-auth#sign-in

[nandorojo]

Okay got it, so I can just call the same signInWithPhoneNumber method then. I’ll add a flow for this, thanks.