flutterfire icon indicating copy to clipboard operation
flutterfire copied to clipboard
verified publisher icon firebase

[firebase_auth]: resolveSignIn fails with “The user does not have a second factor matching the identifier provided” despite matching resolver hint UID and fresh verificationId

Open DJ2695 opened this issue 3 weeks ago • 2 comments

Is there an existing issue for this?

  • [x] I have searched the existing issues.

Which plugins are affected?

Auth

Which platforms are affected?

iOS

Description

  • Issue: When resolving MFA phone verification via MultiFactorResolver, resolveSignIn throws “The user does not have a second factor matching the identifier provided.” This happens even when:
    • There is exactly one PhoneMultiFactorInfo hint with a stable UID.
    • verifyPhoneNumber is called with resolver.session and the selected hint.
    • The latest verificationId from codeSent is used and the user-entered code is correct.
  • Expected: resolveSignIn should succeed when verificationId originates from verifyPhoneNumber(resolver.session, selected hint) and the correct code is entered.
  • Actual: resolveSignIn fails with the above message. Diagnostics confirm the factor UID in resolver.hints matches at verify time.

Reproducing the issue

  1. Trigger sign-in with Google (or email+password) to get FirebaseAuthMultiFactorException.
  2. Read resolver.hints, select the single PhoneMultiFactorInfo (factorUid recorded).
  3. Call verifyPhoneNumber with:
    • multiFactorSession: resolver.session
    • multiFactorInfo: selected PhoneMultiFactorInfo (the same UID)
    • codeSent: store the new verificationId
  4. User enters the SMS code. Build credential via PhoneAuthProvider.credential(verificationId, smsCode).
  5. Build assertion via PhoneMultiFactorGenerator.getAssertion(credential).
  6. Call resolver.resolveSignIn(assertion).
  7. Observe failure: “The user does not have a second factor matching the identifier provided.”

Minimal Repro (pseudocode)

final resolver = (e as FirebaseAuthMultiFactorException).resolver;
final hints = resolver.hints.whereType<PhoneMultiFactorInfo>().toList();
final hint = hints.first; // only one phone hint in our case

await FirebaseAuth.instance.verifyPhoneNumber(
  multiFactorSession: resolver.session,
  multiFactorInfo: hint,
  verificationCompleted: (_) {}, // ignore auto
  codeSent: (verificationId, _) {
    // user enters code...
    final credential = PhoneAuthProvider.credential(
      verificationId: verificationId,
      smsCode: userCode,
    );
    final assertion = PhoneMultiFactorGenerator.getAssertion(credential);
    resolver.resolveSignIn(assertion); // => throws “no matching second factor”
  },
  codeAutoRetrievalTimeout: (_) {},
  verificationFailed: (e) => print(e),
);

Emulator/Environment Note

  • Using Firebase Emulator via Docker with firebase-tools pinned:
    • FIREBASE_TOOLS_VERSION=14.15.2 (see Dockerfile.firebase)
  • Issue also reproduces on emulator backend with a physical iOS device.

Firebase Core version

4.2.1

Flutter Version

3.38.3

Relevant Log Output

- [MFA] verifying challenge factorUid=JIXR7ltePy8mMzzGSHJz1XRnffDP verificationId=bsaRmo3MKLHt... code=759034
- [MFA] current resolver hints UIDs: JIXR7ltePy8mMzzGSHJz1XRnffDP
- Exception: The user does not have a second factor matching the identifier provided.

Flutter dependencies

Expand Flutter dependencies snippet 

dependencies:
- auto_route 10.2.3 [flutter path web collection meta]
- auto_route_generator 10.2.5 [build source_gen analyzer path code_builder dart_style glob lean_builder auto_route]
- bloc 9.0.0 [meta]
- cloud_firestore 6.1.0 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta]
- cloud_functions 6.0.4 [cloud_functions_platform_interface cloud_functions_web firebase_core firebase_core_platform_interface flutter]
- fake_cloud_firestore 4.0.0 [flutter cloud_firestore cloud_firestore_platform_interface collection plugin_platform_interface quiver rxdart mock_exceptions fake_firebase_security_rules rx equatable clock]
- file_picker 10.1.9 [flutter flutter_web_plugins flutter_plugin_android_lifecycle plugin_platform_interface ffi path win32 cross_file web]
- firebase_auth 6.1.2 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta]
- firebase_core 4.2.1 [firebase_core_platform_interface firebase_core_web flutter meta]
- firebase_storage 13.0.4 [firebase_core firebase_core_platform_interface firebase_storage_platform_interface firebase_storage_web flutter]
- flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine]
- flutter_bloc 9.1.1 [bloc flutter provider]
- flutter_cache_manager 3.4.1 [clock collection file flutter http path path_provider rxdart sqflite uuid]
- flutter_dotenv 5.2.1 [flutter]
- flutter_expandable_fab 2.5.1 [flutter]
- flutter_localization 0.3.2 [flutter flutter_web_plugins flutter_localizations web universal_io shared_preferences plugin_platform_interface]
- flutter_secure_storage 9.2.4 [flutter flutter_secure_storage_linux flutter_secure_storage_macos flutter_secure_storage_platform_interface flutter_secure_storage_web flutter_secure_storage_windows meta]
- formz 0.8.0 [meta]
- fpdart 1.1.1
- freezed_annotation 3.1.0 [collection json_annotation meta]
- get_it 7.7.0 [async collection meta]
- go_router 15.1.2 [collection flutter flutter_web_plugins logging meta]
- google_sign_in 6.3.0 [flutter google_sign_in_android google_sign_in_ios google_sign_in_platform_interface google_sign_in_web]
- intl 0.20.2 [clock meta path]
- json_annotation 4.9.0 [meta]
- meta 1.17.0
- modal_bottom_sheet 3.0.0 [flutter]
- network_info_plus 6.1.4 [collection nm flutter flutter_web_plugins meta network_info_plus_platform_interface win32 ffi]
- path_provider 2.1.5 [flutter path_provider_android path_provider_foundation path_provider_linux path_provider_platform_interface path_provider_windows]
- shadcn_flutter 0.0.47 [email_validator flutter skeletonizer country_flags phonecodes cross_file web data_widget gap expressions]
- shadcn_ui 0.39.10 [boxy collection flutter flutter_animate flutter_localizations flutter_svg intl lucide_icons_flutter theme_extensions_builder_annotation two_dimensional_scrollables universal_image vector_graphics]
- share_plus 10.1.4 [cross_file meta mime flutter flutter_web_plugins share_plus_platform_interface file url_launcher_web url_launcher_windows url_launcher_linux url_launcher_platform_interface ffi web win32]
- shared_preferences 2.5.3 [flutter shared_preferences_android shared_preferences_foundation shared_preferences_linux shared_preferences_platform_interface shared_preferences_web shared_preferences_windows]
- syncfusion_flutter_pdfviewer 29.2.7 [flutter vector_math web async http uuid device_info_plus intl syncfusion_pdfviewer_platform_interface syncfusion_pdfviewer_web syncfusion_pdfviewer_macos syncfusion_pdfviewer_windows syncfusion_flutter_core syncfusion_flutter_pdf syncfusion_flutter_signaturepad url_launcher]
- truncate 3.0.1

dev dependencies:
- bloc_test 10.0.0 [bloc diff_match_patch meta mocktail test]
- build_runner 2.10.4 [analyzer args async build build_config build_daemon built_collection built_value code_builder collection convert crypto dart_style glob graphs http_multi_server io json_annotation logging meta mime package_config path pool pub_semver shelf shelf_web_socket stream_transform watcher web_socket_channel yaml]
- flutter_test 0.0.0 [flutter test_api matcher path fake_async clock stack_trace vector_math leak_tracker_flutter_testing collection meta stream_channel]
- freezed 3.2.3 [analyzer build build_config collection meta source_gen freezed_annotation json_annotation dart_style pub_semver]
- json_serializable 6.11.2 [analyzer async build build_config dart_style json_annotation meta path pub_semver pubspec_parse source_gen source_helper]
- mocktail 1.0.4 [collection matcher test_api]
- very_good_analysis 8.0.0

transitive dependencies:
- _fe_analyzer_shared 91.0.0 [meta]
- _flutterfire_internals 1.3.64 [collection firebase_core firebase_core_platform_interface flutter meta]
- analyzer 8.4.1 [_fe_analyzer_shared collection convert crypto glob meta package_config path pub_semver source_span watcher yaml]
- ansicolor 2.0.3
- antlr4 4.13.2 [logging collection]
- args 2.7.0
- async 2.13.0 [collection meta]
- boolean_selector 2.1.2 [source_span string_scanner]
- boxy 2.2.1 [flutter vector_math]
- build 4.0.3 [analyzer crypto glob logging package_config path]
- build_config 1.2.0 [checked_yaml json_annotation path pubspec_parse]
- build_daemon 4.0.4 [built_collection built_value crypto http_multi_server logging path pool shelf shelf_web_socket stream_transform watcher web_socket_channel]
- built_collection 5.1.1
- built_value 8.10.1 [built_collection collection fixnum meta]
- cel 0.5.3 [antlr4 collection equatable]
- characters 1.4.0
- checked_yaml 2.0.3 [json_annotation source_span yaml]
- cli_config 0.2.0 [args yaml]
- clock 1.1.2
- cloud_firestore_platform_interface 7.0.4 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- cloud_firestore_web 5.1.0 [_flutterfire_internals cloud_firestore_platform_interface collection firebase_core firebase_core_web flutter flutter_web_plugins]
- cloud_functions_platform_interface 5.8.7 [firebase_core flutter meta plugin_platform_interface]
- cloud_functions_web 5.1.0 [cloud_functions_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins web]
- code_builder 4.10.1 [built_collection built_value collection matcher meta]
- collection 1.19.1
- convert 3.1.2 [typed_data]
- country_flags 4.1.0 [collection flutter jovial_svg]
- coverage 1.14.0 [args cli_config glob logging meta package_config path pubspec_parse source_maps stack_trace vm_service]
- cross_file 0.3.4+2 [meta web]
- crypto 3.0.6 [typed_data]
- dart_style 3.1.3 [analyzer args collection package_config path pub_semver source_span yaml]
- data_widget 0.0.2 [flutter]
- dbus 0.7.11 [args ffi meta xml]
- device_info_plus 11.4.0 [device_info_plus_platform_interface ffi file flutter flutter_web_plugins meta web win32 win32_registry]
- device_info_plus_platform_interface 7.0.2 [flutter meta plugin_platform_interface]
- diff_match_patch 0.4.1
- email_validator 3.0.0
- equatable 2.0.7 [collection meta]
- expressions 0.2.5+2 [quiver petitparser rxdart meta]
- extended_image 10.0.1 [extended_image_library flutter meta vector_math]
- extended_image_library 5.0.1 [crypto flutter http_client_helper js path path_provider web]
- fake_async 1.3.3 [clock collection]
- fake_firebase_security_rules 0.5.3 [antlr4 cel equatable logger tuple]
- ffi 2.1.4
- file 7.0.1 [meta path]
- firebase_auth_platform_interface 8.1.4 [_flutterfire_internals collection firebase_core flutter http meta plugin_platform_interface]
- firebase_auth_web 6.1.0 [firebase_auth_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins http_parser meta web]
- firebase_core_platform_interface 6.0.2 [collection flutter flutter_test meta plugin_platform_interface]
- firebase_core_web 3.3.0 [firebase_core_platform_interface flutter flutter_web_plugins meta web]
- firebase_storage_platform_interface 5.2.15 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- firebase_storage_web 3.11.0 [_flutterfire_internals async firebase_core firebase_core_web firebase_storage_platform_interface flutter flutter_web_plugins http meta web]
- fixnum 1.1.1
- flutter_animate 4.5.2 [flutter flutter_shaders]
- flutter_localizations 0.0.0 [flutter intl path]
- flutter_plugin_android_lifecycle 2.0.28 [flutter]
- flutter_secure_storage_linux 1.2.3 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_macos 3.1.3 [flutter flutter_secure_storage_platform_interface]
- flutter_secure_storage_platform_interface 1.1.2 [flutter plugin_platform_interface]
- flutter_secure_storage_web 1.2.1 [flutter flutter_secure_storage_platform_interface flutter_web_plugins js]
- flutter_secure_storage_windows 3.1.2 [ffi flutter flutter_secure_storage_platform_interface path path_provider win32]
- flutter_shaders 0.1.3 [flutter vector_math]
- flutter_svg 2.1.0 [flutter http vector_graphics vector_graphics_codec vector_graphics_compiler]
- flutter_web_plugins 0.0.0 [flutter]
- frontend_server_client 4.0.0 [async path]
- gap 3.0.1 [flutter]
- glob 2.1.3 [async collection file path string_scanner]
- google_identity_services_web 0.3.3+1 [meta web]
- google_sign_in_android 6.2.1 [flutter google_sign_in_platform_interface]
- google_sign_in_ios 5.9.0 [flutter google_sign_in_platform_interface]
- google_sign_in_platform_interface 2.5.0 [flutter plugin_platform_interface]
- google_sign_in_web 0.12.4+4 [flutter flutter_web_plugins google_identity_services_web google_sign_in_platform_interface http web]
- graphs 2.3.2 [collection]
- hotreloader 4.3.0 [collection logging path stream_transform vm_service watcher]
- http 1.4.0 [async http_parser meta web]
- http_client_helper 3.0.0 [http]
- http_multi_server 3.2.2 [async]
- http_parser 4.1.2 [collection source_span string_scanner typed_data]
- io 1.0.5 [meta path string_scanner]
- jovial_misc 0.9.2 [async collection convert meta]
- jovial_svg 1.1.25 [xml collection args vector_math jovial_misc http meta flutter]
- js 0.6.7 [meta]
- leak_tracker 11.0.2 [clock collection meta path vm_service]
- leak_tracker_flutter_testing 3.0.10 [flutter leak_tracker leak_tracker_testing matcher meta]
- leak_tracker_testing 3.0.2 [leak_tracker matcher meta]
- lean_builder 0.1.3 [_fe_analyzer_shared analyzer args xxh3 path collection meta glob watcher dart_style ansicolor source_span stack_trace frontend_server_client yaml hotreloader]
- logger 2.5.0
- logging 1.3.0
- lucide_icons_flutter 3.0.4 [flutter]
- matcher 0.12.17 [async meta stack_trace term_glyph test_api]
- material_color_utilities 0.11.1 [collection]
- mime 2.0.0
- mock_exceptions 0.8.2 [matcher]
- more 4.5.0 [characters clock collection meta]
- nested 1.0.0 [flutter]
- network_info_plus_platform_interface 2.0.2 [flutter meta plugin_platform_interface]
- nm 0.5.0 [dbus]
- node_preamble 2.0.2
- package_config 2.2.0 [path]
- path 1.9.1
- path_parsing 1.1.0 [meta vector_math]
- path_provider_android 2.2.17 [flutter path_provider_platform_interface]
- path_provider_foundation 2.4.1 [flutter path_provider_platform_interface]
- path_provider_linux 2.2.1 [ffi flutter path path_provider_platform_interface xdg_directories]
- path_provider_platform_interface 2.1.2 [flutter platform plugin_platform_interface]
- path_provider_windows 2.3.0 [ffi flutter path path_provider_platform_interface]
- petitparser 6.1.0 [meta collection]
- phonecodes 0.0.4
- platform 3.1.6
- plugin_platform_interface 2.1.8 [meta]
- pool 1.5.1 [async stack_trace]
- provider 6.1.5 [collection flutter nested]
- pub_semver 2.2.0 [collection]
- pubspec_parse 1.5.0 [checked_yaml collection json_annotation pub_semver yaml]
- quiver 3.2.2 [matcher]
- rx 0.4.0 [collection matcher meta more]
- rxdart 0.28.0
- share_plus_platform_interface 5.0.2 [cross_file flutter meta mime plugin_platform_interface path_provider uuid]
- shared_preferences_android 2.4.10 [flutter shared_preferences_platform_interface]
- shared_preferences_foundation 2.5.4 [flutter shared_preferences_platform_interface]
- shared_preferences_linux 2.4.1 [file flutter path path_provider_linux path_provider_platform_interface shared_preferences_platform_interface]
- shared_preferences_platform_interface 2.4.1 [flutter plugin_platform_interface]
- shared_preferences_web 2.4.3 [flutter flutter_web_plugins shared_preferences_platform_interface web]
- shared_preferences_windows 2.4.1 [file flutter path path_provider_platform_interface path_provider_windows shared_preferences_platform_interface]
- shelf 1.4.2 [async collection http_parser path stack_trace stream_channel]
- shelf_packages_handler 3.0.2 [path shelf shelf_static]
- shelf_static 1.1.3 [convert http_parser mime path shelf]
- shelf_web_socket 3.0.0 [shelf stream_channel web_socket_channel]
- skeletonizer 2.1.0+1 [flutter]
- sky_engine 0.0.0
- source_gen 4.1.1 [analyzer async build dart_style glob path pub_semver source_span yaml]
- source_helper 1.3.8 [analyzer source_gen]
- source_map_stack_trace 2.1.2 [path source_maps stack_trace]
- source_maps 0.10.13 [source_span]
- source_span 1.10.1 [collection path term_glyph]
- sprintf 7.0.0
- sqflite 2.4.2 [flutter sqflite_android sqflite_darwin sqflite_platform_interface sqflite_common path]
- sqflite_android 2.4.1 [flutter sqflite_common path sqflite_platform_interface]
- sqflite_common 2.5.5 [synchronized path meta]
- sqflite_darwin 2.4.2 [flutter sqflite_platform_interface meta sqflite_common path]
- sqflite_platform_interface 2.4.0 [flutter platform sqflite_common plugin_platform_interface meta]
- stack_trace 1.12.1 [path]
- stream_channel 2.1.4 [async]
- stream_transform 2.1.1
- string_scanner 1.4.1 [source_span]
- syncfusion_flutter_core 29.2.7 [vector_math flutter]
- syncfusion_flutter_pdf 29.2.7+1 [flutter intl xml syncfusion_flutter_core crypto convert http]
- syncfusion_flutter_signaturepad 29.2.7 [flutter syncfusion_flutter_core]
- syncfusion_pdfviewer_macos 29.2.7 [flutter syncfusion_pdfviewer_platform_interface]
- syncfusion_pdfviewer_platform_interface 29.2.7 [flutter plugin_platform_interface]
- syncfusion_pdfviewer_web 29.2.7 [flutter flutter_web_plugins web syncfusion_pdfviewer_platform_interface]
- syncfusion_pdfviewer_windows 29.2.7 [flutter]
- synchronized 3.3.1
- term_glyph 1.2.2
- test 1.26.3 [analyzer async boolean_selector collection coverage http_multi_server io js matcher node_preamble package_config path pool shelf shelf_packages_handler shelf_static shelf_web_socket source_span stack_trace stream_channel test_api test_core typed_data web_socket_channel webkit_inspection_protocol yaml]
- test_api 0.7.7 [async boolean_selector collection meta source_span stack_trace stream_channel string_scanner term_glyph]
- test_core 0.6.12 [analyzer args async boolean_selector collection coverage frontend_server_client glob io meta package_config path pool source_map_stack_trace source_maps source_span stack_trace stream_channel test_api vm_service yaml]
- theme_extensions_builder_annotation 7.0.0 [meta]
- tuple 2.0.2
- two_dimensional_scrollables 0.3.4 [flutter]
- typed_data 1.4.0 [collection]
- universal_image 1.0.10 [flutter flutter_svg extended_image]
- universal_io 2.2.2 [collection meta typed_data]
- url_launcher 6.3.1 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows]
- url_launcher_android 6.3.16 [flutter url_launcher_platform_interface]
- url_launcher_ios 6.3.3 [flutter url_launcher_platform_interface]
- url_launcher_linux 3.2.1 [flutter url_launcher_platform_interface]
- url_launcher_macos 3.2.2 [flutter url_launcher_platform_interface]
- url_launcher_platform_interface 2.3.2 [flutter plugin_platform_interface]
- url_launcher_web 2.4.1 [flutter flutter_web_plugins url_launcher_platform_interface web]
- url_launcher_windows 3.1.4 [flutter url_launcher_platform_interface]
- uuid 4.5.1 [crypto sprintf meta fixnum]
- vector_graphics 1.1.18 [flutter http vector_graphics_codec]
- vector_graphics_codec 1.1.13
- vector_graphics_compiler 1.1.17 [args meta path path_parsing vector_graphics_codec xml]
- vector_math 2.2.0
- vm_service 15.0.0
- watcher 1.1.4 [async path]
- web 1.1.1
- web_socket 1.0.1 [web]
- web_socket_channel 3.0.3 [async crypto stream_channel web web_socket]
- webkit_inspection_protocol 1.2.1 [logging]
- win32 5.13.0 [ffi]
- win32_registry 2.1.0 [ffi meta win32]
- xdg_directories 1.1.0 [meta path]
- xml 6.5.0 [collection meta petitparser]
- xxh3 1.2.0
- yaml 3.1.3 [collection source_span string_scanner]

Additional context and comments

  • We enforce resolver-only challenges, clear stale verificationIds, and pass the exact hint UID. Guards confirm the resolver still contains the selected factor UID at verify time. Despite this, resolveSignIn fails with the same message.
  • This appears to be an internal mismatch/edge in firebase_auth when linking verificationId/credential to resolver factors.
  • Requesting guidance on known issues with resolver-based MFA in recent firebase_auth, or an updated sample to validate the flow. If session expiry or auto-retrieval races are involved, recommended handling guidance would help.

DJ2695 avatar Nov 26 '25 14:11 DJ2695

I have not been able to reproduce this issue, using your example code in the example app, I think the issue might occur from how you are enabling 2fa. Instead I get the exception that confirms 2FA is there and is needed to sign in.

MichaelVerdon avatar Nov 28 '25 10:11 MichaelVerdon

Hey @DJ2695. We need more information to resolve this issue but there hasn't been an update in 7 weekdays. I'm marking the issue as stale and if there are no new updates in the next 7 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

google-oss-bot avatar Dec 08 '25 18:12 google-oss-bot

Since there haven't been any recent updates here, I am going to close this issue.

@DJ2695 if you're still experiencing this problem and want to continue the discussion just leave a comment here and we are happy to re-open this.

google-oss-bot avatar Dec 16 '25 18:12 google-oss-bot