Secure phone number sms verification process for Webapp

Question

I wanted to verify phone numbers before using them for communication with registred users. However, I am unclear If I'm doing it securely. i.e

Steps I'm taking:

1. Ask user for phone number
2. Send SMS verification code
3. User enters Code
4. Code verified using SMS Service(Sinch or/Twilio)
5. correct code triggers callback function(client side) that adds the number to backend Database
6. Incorrect code does nothing

My concern is step 5. Should I have the success callback function perform the number save on client side or should I trigger some backend(server-side) function that performs the save operation?

Answer 1

So with sinch it works like this, all the steps 1 to 6 is correct on the client. side,

But step 5/6 is more like this 5 Client enters code and send it to Sinch Backend - Return to client with Success or Fail (do ui logic) - Make a callback to your server with status, take action if correct or incorrect.

So the code is never in your possession, injecting the add to database on client side not possible, since you can get Success to the client and then in the client reload you data from your backend that has been updated by the server to server method. Makes sense?

https://www.sinch.com/docs/verification/rest/#howtousetheverificationapis

Answer 2

Twilio developer evangelist here.

I'd definitely do the code verification on the server side and then if that is successful save the number to the database. Any verification and success callbacks on the client side could surely be bypassed by an attacker with knowledge of JavaScript.

Rather than using Twilio directly for this, might I suggest you check out Authy's phone verification API. Authy is part of Twilio, but is more specific to verification and two factor authentication workflows.

I'm not sure what your backend is written in, however there are tutorials for verifying a phone number with Authy on the Twilio site. We have examples in Node, Ruby, Python, .NET, PHP and Java.

I'm not sure if this helps at all. Let me know if you have any other questions.