https://supabase.com/ logo
Powered by
Hey guys, i have a weird case going on and i dont ...
# help
b
Hey guys, i have a weird case going on and i dont know if it is the expected behavior. When a user enters my app for the first time, he creates his account via Phone Auth, only with a OTP and without a password. He can however create a new password for his account (auth.update({password: '...'})) It works fine, i can see his password on my database, but when i try to login again with the same phone number without a password, it lets me login without errors. Is that the expected behavior in this case?
n
Hello @Bicijay! This thread has been automatically created from your message in #843999948717555735 a few seconds ago. We have already mentioned the @User so that they can see your message and help you as soon as possible! Want to unsubscribe from this thread? Right-click the thread in Discord (or use the ``...`` menu) and select "Leave Thread" to unsubscribe from future updates. Want to change the title? Use the ``/title`` command! We have solved your problem? Click the button below to archive it.
s
Did the user get an OTP when the logged in the second time without a password?
b
Yeah, but shouldnt the lib require a password now that he has one registered?
Because when the user enters the app for the first time i wanted to keep the signup process as easy as possible to increase conversions. So he would just enter his phone and the OTP and he was done, but if he wants to increase the account security he could add a new password, so now he would have to login with the phone + password, not only with the OTP
One alternative that i have thought is to let him add a new email and password if he wants to increase security or not be dependable on his phone only, but i would have to disable the phone auth after he register and confirm his email, and i dont know if thats possible
s
I don't think it is possible to disable phone auth after he has entered a password. The user was originally authenticated via phone auth so this behaviour is the default for the user.
b
Hmm but shouldnt the lib ask for a password after he creates a new one? So he would login only with the OTP in the first time, but if he adds a password he would need to login with the phone number and password
s
I think this is a one or the other scenario, if you allowed the user to signup with phone number only then its a phone number only default setup. If you signed the user up with phone number and password then it should be a phone number and password default.
Have you had a look at this guide https://supabase.com/docs/guides/auth/auth-twilio
b
Yeah i did, but to be honest i was hoping to let the user signup without a password and add it later if needed. Because he would land in the onboard page and only inform the phone number and confirm the OTP, after that he would already have an account. (That would really increase the conversion rate) But later if he wants, he could add another layer of security (email,password...) and disable the OTP only sign in. (Maybe he lost the access to his phone number, or them sim was hijacked...)
So i will probably have to go with: Create a account with Phone number + password, and capture his email later to make sure he can reset his password in case he looses access to his phone number
Thinking about it, i think its easier just to use email + password in this case... Because if he forgets his password he cant reset it via phone number yet it seems :/
s
Yeah this is probably the better option, you could even do email only(magic link) signup to increase the conversion rate and then add password later.
b
Yeah i saw the magic link method but i dont think it would work nice with a mobile app + web app, i saw that you guys implemented a token as well but it is too long for the user to copy, it would be better a 6 digit OTP like the phone auth
But thanks for the help! I will figure something out
n
Thread was archived by @Bicijay. Anyone can send a message to unarchive it.
b
@silentworks Sorry, i ended up archiving the thread. But i think i got something. Is there any way i could update the email from a user created by phone auth? Im trying it here but the confirmed_at column keeps null even after clicking the email link
And i think i saw some unanswered issues about it from last year :/
Im gonna be honest, it seems a lot of auth cases (update email, update password, multiple login methods) were not implemented, i dont think the auth module is production ready yet, ill stick with firebase for now but ill keep an eye for supabase 🙂
n
Thread was archived by @Bicijay. Anyone can send a message to unarchive it.
s
All of what you mention here are implemented. I guess some of your use case for these features are just not covered.
b
when i try to update an email for example, even after i confirm the change through the link, the email_confirmed_at column is kept null.
s
Take a look at this SO answer https://stackoverflow.com/a/72512364/811799
b
I saw that one, but in my case the user didn’t have a old email to confirm, only the new one. So the code is probably not expecting this scenario where the old_email was null
PreviousNext
Powered by