[firebase_auth] Is there a plan to support multifactor authentication (so called MFA/2FA)?

[fysoul17]

I found that Google has released multi-factor authentication recently.

https://cloud.google.com/identity-platform/docs/web/mfa

and thus, I am just wondering if there is a plan to implement this feature soon.

I know that there is some sort of workaround solution using 'userClaim', but it would be greater if we can use official way of MFA.

[TahaTesser]

Hi @fysoul17
Please checkout this answer
Since it's not supported in Firebase, i am closing this issue
if you disagree please write in the comments and I will reopen it
Thank you

[fysoul17]

Hi @TahaTesser

Please check the link I provided. In fact, it is supported by Firebase now. It is an example of Firebase.

Also, the link you provided was an old answer, if you scroll down to recent reply, it also said Firebase is now supporting MFA only when you enable Identity Provider.

Thanks in advance for further support. ;)

[nilsreichardt]

It was released with v7.11.0: https://firebase.google.com/support/release-notes/js#version_7110_-_march_12_2020 😍

[kaarens93]

I see mfa is supported but how do we implement with flutter? I tried to use cloud functions but I don't think it's possible. See below code. I have no way of getting "user" because I can't pass user as a parameter in the cloud function. The way I have called auth.currentUser returns null because I used firebase_auth package. There's no method to get user by UID either so I don't think there's much I can do, right?

var firebase = require("firebase")

firebase.initializeApp({
  // config
});

const auth = firebase.auth();

exports.add2fa = functions.https.onCall((data, context) => {
  const user = auth.currentUser; // trouble here
  const cred = firebase.auth.PhoneAuthProvider.credential(data.verificationId, data.code);
  const multiFactorAssertion = firebase.auth.PhoneMultiFactorGenerator.assertion(cred);
  user.multiFactor.enroll(multiFactorAssertion, 'phone number');
})

[Ehesp]

I've taken a look into this as part of #2582 , we've decided that we'll first get the API stable and then look at introducing MFA. Another potential issue is that iOS support is in beta and the underlying web library wrapper doesn't support it.

[nilsreichardt]

Hi @Ehesp, is this still a part of #2582?

[gazialankus]

If we were to use the native SDKs for multi-factor, to complement Flutter's Firebase Auth, would that work? https://cloud.google.com/identity-platform/docs/android/mfa

Can we transfer some token between native and Flutter to recreate the auth state in the other side?

[zepolyerf]

Have you found an answer to this, @gazialankus?

[gazialankus]

This is the only other thing that I know: https://twitter.com/gazialankus/status/1367185139537752064

Currently we're using Phone Auth as a means of SMS verification in a bit tricky way. Everyone has a regular account linked with a phone account. We can force user to log in with the phone account when we want.

[zepolyerf]

Any update about this? It sucks that I can't use Google Identity Platform multifactor auth with my Flutter app when I can easily integrate it with my other project using Angular.

[amitav13]

We're considering making separate platform-specific channels and integrating the firebase android/ios SDKs separately. Not seeing much activity here :(

[dragonkhoi]

Was this manageable?

[amitav13]

We haven't gotten to this yet, kicking it down the road in hopes of getting a solution here 😅

In theory it should definitely be feasible though, just need an understanding of native code on both ends.

[MrJai]

Is there any update on this? I really have to implement multifactor auth, and I am using Firebase for the most part of my app.

[ManuelWeidijkQict]

I really need multifactor auth in my Flutter app. Did anyone figure out how to do this yet in a different way or is there any update on this?

[MSchmack]

This topic seems to be getting pushed down even tho it's a core feature of authentication for security consious applications. As good as any application aimed at mid to enterprise sized organizations that is hosted outside of intranets utilizes 2-factor / MFA auth.
Firebase auth get's branded and marketed as first class citizen but this feature is already over a year old.

[gazialankus]

Is there a github issue that we can push?

[MSchmack]

There was one but it got closed due to being a "duplicate" with this open discussion.

#6287

[ManuelWeidijkQict]

Hello,
After trying many things out i finally got this to work in some way.
I have to say that im still a junior developer so I hope I am not teaching you something wrong 😊
But this should atleast help you a bit.
Note: make sure you turn MFA on in your project: https://console.cloud.google.com/customer-identity/mfa
You can set here some testing phone numbers if you want.

Cloudfunction
1. To create users i made use of a callable firebase cloud function: https://firebase.google.com/docs/functions/callable
You can implement this with App Check for more security.
2. Next you can create mfa users with the Firebase admin sdk in your cloud function:
https://cloud.google.com/identity-platform/docs/admin/manage-mfa-users
In flutter app
3. Now you created an user with mfa its time to login.
You can do this with the following API calls, you can use the dart http packet for this:
https://cloud.google.com/identity-platform/docs/reference/rest/v1/accounts/signInWithPassword
4. this will return mfaPendingCredential which you can use here
https://cloud.google.com/identity-platform/docs/reference/rest/v2/accounts.mfaSignIn/start
this will send a code to the phone of the mfa user
Cloudfunction
5. This code you need fort his API call https://cloud.google.com/identity-platform/docs/reference/rest/v2/accounts.mfaSignIn/finalize
You can also place this in a callable firebase cloud function, you can pass the phone code tot this cloud function.
Which again you can make more secure with app check.
6. Once the user succesfully logged in you can create a custom token with the Firebase admin sdk in your cloud function: https://firebase.google.com/docs/auth/admin/create-custom-tokens
In flutter app
7. You can return this token and pass it back to your application to login with
await auth.FirebaseAuth.instance.signInWithCustomToken(token); from Flutter Fire

I hope that this helped you guys a bit.

[dominicmh]

Thanks for sharing @ManuelWeidijkQict!
Here's a guide that goes into even more detail: https://zenn-dev.translate.goog/tsuruo/articles/829a8d2fcbccdb (it's translated from Japanese to English with Google Translate).

And the according GitHub repo

Kudos to @htsuruo!

[MSchmack]

I created a issue to ask for a update on this feature for there has been no response for some time now.

#7290 (comment)

[dominicmh]

Has anyone managed to retrieve real SMS using the HTTP REST approach described by @ManuelWeidijkQict and @htsuruo?
I'm getting an error MISSING_CLIENT_IDENTIFIER (on Android).
I've enabled app verification by enabling Android DeviceCheck API and adding my debug fingerprints in the Firebase console.

Am I missing setup steps that usually would be handled by the Firebase libraries?
I tried passing fingerprint in the request header as suggested here – no success.

Thanks for any help and hints!

[dominicmh]

As to iOS it is a more complex, so I created a gist to demonstrate: ios_app_verification.dart.

Basically, you need to call the verifyIosClient endpoint which triggers a silent push notification. This push notification contains the information (iosReceipt and iosSecret) that need to be passed to the accounts.mfaEnrollment/start & accounts.mfaSignIn/start endpoints.

[cbenhagen]

@dominicmh && @htsuruo thank you for all your work on this! I have successfully implemented MFA for web, Android, iOS and macOS based on this. It seems that the silent push notification sent by the verifyIosClient endpoint is not guaranteed to be delivered. Also it will not work when "Background App Refresh" is disabled on an iOS device. So implementing reCAPTCHA is mandatory.

Now my question: Do you have a nice idea how to best implement that? I mean maybe somehow the implementation of the Firebase iOS SDK could be used? Maybe only for this, or for all the MFA stuff. If this is not used, I guess we would need to open a webview? Any information on that topic would be highly appreciated.

[dominicmh]

Hi @cbenhagen, my implementation was only used for a proof of concept, so I didn't implement the reCAPTCHA part. If I had to, I'd implement it with a with a headless web view. flutter_inappwebview supports it. But I'd also check for alternatives as flutter_inappwebview seems to become inactive.

All in all, I would really reconsider implementing MFA with the REST API. There are many steps involved and edge cases to be handled. I bet implementing method channels to the native SDKs would be less effort and more stable. I believe you'd also have the benefit of a shared session with the Flutter library (firebase_auth) without any additional setup. So I'd probably choose this approach.

[sccrgoalie1]

@cbenhagen @dominicmh Were there any tricks to getting to verifyIosClient to work? I keep getting the following error running on a physical device.

{
    "error": {
        "code": 400,
        "message": "OPERATION_NOT_ALLOWED",
        "errors": [
            {
                "message": "OPERATION_NOT_ALLOWED",
                "domain": "global",
                "reason": "invalid"
            }
        ]
    }
}

[dominicmh]

@sccrgoalie1
You certainly need to add the header X-iOS-Bundle-Identifier to the request. I just pulled the info from Firebase.app() in my PoC:
'X-iOS-Bundle-Identifier': Firebase.app().options.iosBundleId ?? ''

If you already did that, next step would probably be to inspect whether the silent push notification works as expected. If you have "Background App Refresh" disabled on your device (or for other possible reasons that I don't know), you also need the reCAPTCHA implementation for verifyIosClient to work.
Hope that helps!

[Lyokone]

It's now supported. You can follow instructions from this blog post: https://invertase.io/blog/flutterfire-mfa-tutorial

[davidmigloz]

Currently MFA is unusable in production because of this bug:
#9402

Any chance the team can look into it? Thanks!

[Nantris]

What about non-SMS 2fa? Will that ever be supported?

[mmeyer-civic]

It’s in beta now and works in flutter too. https://firebase.google.com/docs/auth/web/totp-mfa