AWS Cognito能否实现类似WhatsApp的仅手机号用户认证？密码存储方案咨询

Absolutely, you can build a WhatsApp-like phone-only authentication flow with AWS Cognito—let’s break down your questions clearly and practically:

1. 能否实现仅手机号用户认证？ #

Yes, and it’s a fully supported native flow with Cognito User Pools if you configure things right. Here’s how to set it up:

• Set phone number as the sole sign-in identifier: When creating your Cognito User Pool, set the sign-in option to only phone numbers (use the phone number directly as the username). Disable email or username sign-in methods entirely.
• Build a passwordless SMS auth flow: Use Cognito’s Custom Auth Challenge feature to skip passwords entirely. The flow mirrors WhatsApp’s experience:
  1. User enters their phone number in your app.
  2. Your backend triggers a Cognito custom challenge, which sends a one-time SMS verification code to the provided number.
  3. User inputs the code, and Cognito validates it to complete authentication (for both registration and login).
• Skip password requirements: In your User Pool settings, you can configure user creation to not require a password (or auto-generate one but never use it). The custom auth flow will handle all verification via SMS, no passwords needed.

This approach is clean, user-friendly, and exactly matches the "phone-only" experience you’re aiming for.

2. 关于Mobile Hub要求手机号+密码的处理方案 #

If you’re temporarily constrained to using Mobile Hub’s default template that enforces both phone number and password, generating a random password and storing it in the device’s Keychain is a valid workaround—though it’s not the most elegant solution. Here’s what you need to know:

• Implementation steps:
  1. After the user verifies their phone number via SMS, generate a long, secure random password (e.g., a 32-character alphanumeric string) directly on the client side.
  2. Use this random password to complete the Mobile Hub/Cognito registration flow (pairing it with the verified phone number).
  3. Store the password securely in the device’s Keychain (iOS) or Keystore (Android)—these are system-level secure storage tools that prevent unauthorized access.
  4. For future logins, automatically retrieve the password from the secure storage and submit it alongside the phone number, so the user never sees or interacts with the password.
• Key caveats:
  • If the user uninstalls and reinstalls the app, the stored password will be lost. You’ll need to add a "password reset" flow that uses the phone number to generate a new password, then re-store it in the secure storage.
  • This adds extra complexity compared to the native passwordless flow, so I’d recommend migrating away from the Mobile Hub default template to use the custom auth flow if possible.

Final Recommendation #

Opt for the passwordless SMS custom auth flow for Cognito—it’s the most aligned with WhatsApp’s user experience, eliminates password-related friction, and is a natively supported feature. The Keychain workaround works if you’re stuck with Mobile Hub’s existing setup, but it’s a temporary band-aid rather than a long-term solution.

内容的提问来源于stack exchange，提问作者WeCanBeFriends