nadetastic
commented
8 months ago Hi @ChristopherGabba thank you for opening this issue. As you have pointed out, the workflow that you are experiencing is expected and is how Cognito creates users. However, note that although the user is created, they remain as unconfirmed until they either complete a verification flow, or is confirmed through an Administrator action [1]. Note that a user who is unconfirmed is unable to sign in until they are confirmed by by verifying themselves via email or phone.
One potential solution to address you concern of a phone number being blocked forever - you may be able to automate a process that periodically Deletes a user based on their confirmation status.
[1] https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html
ChristopherGabba
Before opening, please confirm:
JavaScript Framework
React Native
Amplify APIs
Authentication
Amplify Version
v6
Amplify Categories
auth
Backend
Amplify CLI
Environment information
Describe the bug
When using Amplify Authentication with SMS verification, the user is created in AWS Cognito before they verify the six digit code.
This creates a major security flaw in the authentication flow. Someone could create a bot or script to create a million different accounts with phone numbers and just block all of them out without having to verify.
Expected behavior
A user should not be created within cognito until AFTER the user has been verified.
Reproduction steps
My authentication flow:
Code Snippet
Refer to the above.
Log output
aws-exports.js
/ eslint-disable / // WARNING: DO NOT EDIT. This file is automatically generated by AWS Amplify. It will be overwritten.
const awsmobile = { "aws_project_region": "us-east-1", "aws_appsync_graphqlEndpoint": "https://5tvnvesrgjfjdclupp5rzrh5gi.appsync-api.us-east-1.amazonaws.com/graphql", "aws_appsync_region": "us-east-1", "aws_appsync_authenticationType": "API_KEY", "aws_appsync_apiKey": REDACTED, "aws_cognito_identity_pool_id": REDACTED, "aws_cognito_region": "us-east-1", "aws_user_pools_id": "us-east-1_eDAImGHL9", "aws_user_pools_web_client_id": "4uj0jgf4p8m3au9h8u6g429111", "oauth": {}, "aws_cognito_username_attributes": [], "aws_cognito_social_providers": [], "aws_cognito_signup_attributes": [ "GIVEN_NAME", "FAMILY_NAME", "BIRTHDATE", "PHONE_NUMBER" ], "aws_cognito_mfa_configuration": "OFF", "aws_cognito_mfa_types": [], "aws_cognito_password_protection_settings": { "passwordPolicyMinLength": 8, "passwordPolicyCharacters": [ "REQUIRES_LOWERCASE", "REQUIRES_UPPERCASE", "REQUIRES_NUMBERS", "REQUIRES_SYMBOLS" ] }, "aws_cognito_verification_mechanisms": [ "PHONE_NUMBER" ], "aws_user_files_s3_bucket": "reelfeelmedia", "aws_user_files_s3_bucket_region": "us-east-1" };
export default awsmobile;
Manual configuration
No response
Additional configuration
No response
Mobile Device
iPhone 12 (physical)
Mobile Operating System
iOS 17.2.1
Mobile Browser
N/A
Mobile Browser Version
N/A
Additional information and screenshots
I created a random account with a random phone number and random name but didn't verify and now that phone number is blocked forever even though no one has verified it.