We are building an online shop using django. We have developed an API for our application to interact with Twilio. This is so users can buy products on WhatsApp from our application. I want to know what could go wrong with this setup.
When a user starts a new conversation with the Twilio chatbot. A request is made to the API to check if there is any user associated with the WhatsApp number used. If a user exists with the WhatsApp number used then we have identified our user. We don’t need a password and username to authenticate our users.
If the number used by the user is not associated with any account. It means this user is not registered yet. This user has to register using WhatsApp. Or they can visit the website and create a new account. So there are two ways the user can register. When registering using WhatsApp, the user will enter a username, email, password, confirm_password, first_name, last_name, and other required details.
After registering the user will never be asked again to enter this information. Remember we said the phone number will be used to identify our user. For security reasons, we will tell the user to delete the password and confirm_password from the chat and store it somewhere safe. They will use their password and username to authenticate on our website.
Next time the user chats with our chatbot they don’t need to enter any sensitive information because they will be automatically identified. There is no need for authentication since WhatsApp is giving us a layer of protection. Only the owner of the phone number gets to chat with our chatbot.