I'm building an app where the users should have restricted access to certain api-services. I use gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to verify. If it's the same, the backend generates an UUID which will be sent to the user and safed in a local database on the mobile phone. The user is then able to authenticate itself on the backend by just sending the UUID.

While I'm in that process I noticed that the Firebase Token also never changes so I have two unique id's which are saved in the database.

Is it safe to skip the generation of an extra UUID and verify the user by it's Firebase Token/UID, only? The client could send the verification code with the Firebase Token and if the Firebase Token is correct, the backend will save this token to the database. The client can then authorize itself with that token. Or do I miss a point here?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.