Authentication with Phone Number
Last updated
Last updated
This page contains recommendations for the implementation of the authentication scheme where a phone number and one-time password are used as proof of identity.
Implement the authentication on the server side. In other words, all authentication decisions must be made on the server side.
Generate an OTP on the server side and send it to a user by their phone number via SMS or push.
Return the same error message for an incorrect OTP for an existing and non-existing phone number.
Require authentication from a user when changing a phone number. A user should enter an OTP for an old phone number and a new one.
Successful authentication
Failed authentication
Successful phone number change
Failed phone number change
Implement injection protection for login and password arguments, see:
Notify a user via an available communication channel (email, push, SMS, etc.) about successful login under their account from an unknown location, browser, client, etc.
Comply with requirements from the page.
Comply with requirements from the page.
Log all authentication decisions (successful and not successful), see the page.
Limit the number of attempts to sign in for a certain period, see the page.
Limit the possibility of resending OTPs. In other words, each subsequent send of an OTP must increase the timeout when the OTP resend is prohibited. The timeout is reset by a successful login to an application. See the page.
Comply with requirements from the page.
Enforce multi-factor authentication, see the page.
Generate an OTP on the client side using a TOTP algorithm, see the page.
