Open radoslavzeman opened 1 month ago
@radoslavzeman, can you clarify in which step of your Auth flow that's using this custom lambda in "Pre sign-up Lambda trigger" that the user enters their phone number? Are you able to share the code of the lambda as well?
It sounds like what is happening is there are two user accounts created within the user pool that differ only by the number used. But just to confirm, you're seeing that texts messages aren't able to be sent to BOTH users (even the one with the improper prefixed "0") for MFA uses?
Hi @cwomack, I updated the issue description with correct reproduction steps and code snippets.
We use custom lambda in Sign-up > Pre sign-up trigger
, as mentioned in issue description and attached in screenshots here in case.
export const handler = async (event) => {
event.response.autoConfirmUser = true;
return event;
};
Also, MFA should be enabled and required in "Sing-in experience".
Regarding this question:
It sounds like what is happening is there are two user accounts created within the user pool that differ only by the number used. But just to confirm, you're seeing that texts messages aren't able to be sent to BOTH users (even the one with the improper prefixed "0") for MFA uses?
Yes, I confirm that there are two user accounts created within the user pool that differ only by the number used.
But the problem is, that even if user signs in with zero or without zero, the MFA text message is sent to the same number (without zero). That means, the user can accidentally create two different accounts, thinking they signed in to the same account (because they receive the verification message in both cases).
The solution is, it should not be allowed to create the account with zero at all. The number with zero is not in valid international format. You even cannot dial the number with zero.
Hello @cwomack, do you have some news about this issue?
Before opening, please confirm:
JavaScript Framework
React Native
Amplify APIs
Authentication
Amplify Version
v6
Amplify Categories
auth
Backend
None
Environment information
Describe the bug
In
signIn()
, when MFA is enabled, Cognito sends a verification sms to phone number even if it's in wrong format with leading zero after country code.Example: Country code: +421 (Slovakia) National phone number format: 09xx xxx xxx International phone number format: +421 9xx xxx xxx - the leading zero is removed from national format
Sometimes, users enter the number with leading zeros as "+421 09xx xxx xxx".
Actual behaviour: We sign-up and sign-in users by phone number in out React Native app. We use static password for sign-up and sign-in and MFA verification SMS as one-time-password for sign-in. The signup/signin flow is roughly as follows:
signUp
autoConfirmUser = true
(so the SMS is not sent).signIn
that sends the verification SMS.confirmSignIn
is triggered with the verification code the users obtains in SMS and enters into the input.Even if the users enters wrong number "+421 09xx xxx xxx", the SMS is sent to correct number "+421 9xx xxx xxx", but user is signed in with number "+421 09xx xxx xxx".
This leads to situation, when user is able to sign in into two different accounts (with and without the zero) with the same phone number. Obviously, it happens, and users are confused when they do not see their data (when accidentally signed in with zero).
Expected behavior
Expected behaviour: Cognito should not send a verification SMS to wrongly formatted phone number, instead, it should throw an error in
signUp
step when user enters the number in wrong format with "leading" zero ("+421 09xx xxx xxx").Reproduction steps
aws-amplify
latest version (6.3.8 at this time).STATIC_PASS
const.PHONE
const (+421 9xx xxx xxx - any phone number in this format).await signUp({ username: PHONE, password: STATIC_PASS })
.await signIn({ username: PHONE, password: STATIC_PASS })
.await confirmSignIn({ challengeResponse: CODE });
whereCODE
is the verification code you received in SMS.await getCurrentUser()
and you should get your user info.Repeat this with the same phone number but in incorrect format with zero after country code (+421 09xx xxx xxx). You should obtain the SMS on the same phone number, but get completely different user info.
In the code snippet, we use
inquirer
library to prompt the user to enter the verification code into the console.This happens in our React Native app but also in this minimal reproduction example provided.
Code Snippet
package.json:
Our custom "Pre sign-up Lamba trigger":
Log output
aws-exports.js
No response
Manual configuration
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response