Firebase "Phone Verified" missing

Question

I'm using firebase sms verification, on success, I call my backend /complete-signup to do more work with the JWT token generated (that depends on user having verified their phone. not just create an account with it.)

Now, as mentioned in this question, there is no isPhoneVerified() method...and getPhoneNumbe() is no help, a user can signup with their phone, skip the verify code step, and their account will still be created on firebase.

Client side validation (SharedPreferences as mentioned in the answer) is no help, since there's no way to communicate that info securely to my backend (or is there?)..because what's preventing the user from calling my backend /complete-signup from curl..

What I'm thinking:

1. add "phone verified" as custom claim from client (not possible)
2. create custom token on client contaning {userId,phoneVerified} to send to my backend (super insecure!)
3. get the value of the otp code sent by firebase in the backend to verify it (not possible)
4. use another api (really dont want to do this)
5. ??

ideas?

question from:https://stackoverflow.com/questions/65894388/firebase-phone-verified-missing

Answer 1

Waitting for answers