You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add reCAPTCHA Enterprise support for Phone Auth (#8568)
* Update injectRecaptchaFields to inject recaptcha enterprise fields into phone API requests (#7786)
* Update injectRecaptchaFields to inject recaptcha fields into phone API requests
* Fix lint
* Rename captchaResp and fakeToken params
* Format
* Implement reCAPTCHA Enterprise flow for phone provider (#7814)
* Update injectRecaptchaFields to inject recaptcha enterprise fields into phone API requests (#7786)
* Update injectRecaptchaFields to inject recaptcha fields into phone API requests
* Fix lint
* Rename captchaResp and fakeToken params
* Format
* Implement reCAPTCHA Enterprise flow for phone provider
* Cleanup tests
* Make recaptchaEnterpriseVerifier.verify return a mock when appVerificationDisabledForTesting is true
* Lint fix
* yarn docgen devsite
* Mark appVerifier param in Phone Auth APIs as required
* Update API reports
* Change RecaptchaProvider to RecaptchaAuthProvider
* Fix reference docs
* Add more unit tests
---------
Co-authored-by: NhienLam <[email protected]>
* Make ApplicationVerifier params optional in Phone Auth APIs (#8366)
* Make ApplicationVerifier params optional in Phone APIs
* Add more unit tests for when ApplicationVerifier is not available
* Only fetch reCAPTCHA v2 token when FAKE_TOKEN (#8493)
* Proceed to reCAPTCHA v2 if unable to get reCAPTCHA Enterprise enablement state (#8500)
* Proceed to reCAPTCHA v2 if cannot get phone enablement state
* nit: Add a missing period.
* Add integration tests for rCE ENFORCE (#8538)
* Add integration test for rCE ENFORCE
* format
* Add changeset and refdocs
* Bump main firebase package in changeset
* Addressed refdocs feedback
---------
Co-authored-by: NhienLam <[email protected]>
Copy file name to clipboardExpand all lines: docs-devsite/auth.md
+6-4
Original file line number
Diff line number
Diff line change
@@ -923,14 +923,16 @@ Asynchronously signs in using a phone number.
923
923
924
924
This method sends a code via SMS to the given phone number, and returns a [ConfirmationResult](./auth.confirmationresult.md#confirmationresult_interface)<!---->. After the user provides the code sent to their phone, call [ConfirmationResult.confirm()](./auth.confirmationresult.md#confirmationresultconfirm) with the code to sign the user in.
925
925
926
-
For abuse prevention, this method also requires a [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)<!---->. This SDK includes a reCAPTCHA-based implementation, [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class)<!---->. This function can work on other platforms that do not support the [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class) (like React Native), but you need to use a third-party [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface) implementation.
926
+
For abuse prevention, this method requires a [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)<!---->. This SDK includes an implementation based on reCAPTCHA v2, [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class)<!---->. This function can work on other platforms that do not support the [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class) (like React Native), but you need to use a third-party [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface) implementation.
927
+
928
+
If you've enabled project-level reCAPTCHA Enterprise bot protection in Enforce mode, you can omit the [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)<!---->.
927
929
928
930
This method does not work in a Node.js environment or with [Auth](./auth.auth.md#auth_interface) instances created with a [FirebaseServerApp](./app.firebaseserverapp.md#firebaseserverapp_interface)<!---->.
| applicationVerifier |[ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)|For abuse prevention, this method also requires a [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)<!---->. This SDK includes a reCAPTCHA-based implementation, [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class)<!---->. |
214
+
| applicationVerifier |[ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)|An [ApplicationVerifier](./auth.applicationverifier.md#applicationverifier_interface)<!---->, which prevents requests from unauthorized clients. This SDK includes an implementation based on reCAPTCHA v2, [RecaptchaVerifier](./auth.recaptchaverifier.md#recaptchaverifier_class)<!---->. If you've enabled reCAPTCHA Enterprise bot protection in Enforce mode, this parameter is optional; in all other configurations, the parameter is required. |
215
215
216
216
<b>Returns:</b>
217
217
218
218
Promise<string>
219
219
220
-
A Promise for a verification ID that can be passed to [PhoneAuthProvider.credential()](./auth.phoneauthprovider.md#phoneauthprovidercredential) to identify this flow..
220
+
A Promise for a verification ID that can be passed to [PhoneAuthProvider.credential()](./auth.phoneauthprovider.md#phoneauthprovidercredential) to identify this flow.
### Integration testing with the production backend
56
56
57
-
Currently, MFA TOTP and password policy tests only run against the production backend (since they are not supported on the emulator yet).
57
+
Currently, MFA TOTP, password policy, and reCAPTCHA Enterprise phone verification tests only run
58
+
against the production backend (since they are not supported on the emulator yet).
58
59
Running against the backend also makes it a more reliable end-to-end test.
59
60
61
+
#### TOTP
62
+
60
63
The TOTP tests require the following email/password combination to exist in the project, so if you are running this test against your test project, please create this user:
Replace the tenant ID `passpol-tenant-d7hha` in [test/integration/flows/password_policy.test.ts](https://github.com/firebase/firebase-js-sdk/blob/main/packages/auth/test/integration/flows/password_policy.test.ts) with the ID for the newly created tenant. The tenant ID can be found at the end of the `name` property in the response and is in the format `passpol-tenant-xxxxx`.
100
105
106
+
#### reCAPTCHA Enterprise phone verification
107
+
108
+
The reCAPTCHA Enterprise phone verification tests require reCAPTCHA Enterprise to be enabled and
109
+
the following fictional phone number to be configured and in the project.
110
+
111
+
If you are running this
112
+
test against your project, please [add this test phone number](https://firebase.google.com/docs/auth/web/phone-auth#create-fictional-phone-numbers-and-verification-codes):
113
+
114
+
'+1 555-555-1000', SMS code: '123456'
115
+
116
+
Follow [this guide](https://cloud.google.com/identity-platform/docs/recaptcha-enterprise) to enable reCAPTCHA
117
+
Enterprise, then use the following curl command to set reCAPTCHA Enterprise to ENFORCE for phone provider:
0 commit comments