authgear-server
authgear-server copied to clipboard
Lower phone number valid check criteria in the server
Problem
- There are 2 validation offered by the phone library:
- isPossible: Length matched for a given country code, ONLY length is checked.
- e.g.
+852 1xxx xxxx
is a possible number
- e.g.
- isValid: The number is allocated/assigned in the numbering plan.
- e.g.
+852 535x xxxx
is invalid. (See: HK Numbering plan PDF) - e.g.
+1(370)xxx-xxx
is invalid (See: North American numbering plan)
- e.g.
- isPossible: Length matched for a given country code, ONLY length is checked.
- When testing the integration, the user may want to manually import a set of test data into the system. It's common to use the range of numbers of possible length but invalid during test. e.g.
+852 32xx xxxx
are possible but invalid numbers. - This also requires us to update the library rather frequently. For instance in a recent incident, the numbering scheme in HK was updated so the authority is now issuing numbers starting with
4
but our definition was not up-to-date to include these numbers.
Appetite
1 day
Solution
Option 1
- To lower the criteria of accepting a phone number input, to accept all possible numbers. And rely on the OTP verification mechanism to validate the numbers.
- Pros: Less options for the admin. They only need to care if the user have verified by OTP.
- Cons: When the admin enters an invalid number in the portal, they don't know the number is invalid.
Option 2
- Add an option in the portal for the admin to choose if they want to accept invalid numbers
- Option 1
-
[ ] Allow invalid phone numbers; Authgear will check the validity of the number, as long as the length is correct.
-
- Option 2
-
Phone Number Validation
:radio-button-checked: Check phone number validity and length
:radio-button-unchecked: Allow invalid numbers, check phone number length only
-
Phone Number Validation
- Option 1
- Pros:
- It retains the original validity checks. So the admin knows when the length-match number is impossible, so they can tell the user to provide a correct number earlier