Firebase Phone Auth验证码过期问题及认证流程咨询

Hey there! Let's break down how to handle that annoying verification code expiration issue in Firebase Phone Auth.

First, a quick heads-up: Firebase's default verification code expires after 5 minutes, and the associated verificationID becomes invalid right along with it. So when your user enters an expired code, Firebase will throw specific errors—we’ll use those to build a smooth fix.

Step 1: Detect the Expiration Error #

When you attempt to sign in with the credential, watch for two key error types: AuthErrorCode.sessionExpired (the verification session itself timed out) or AuthErrorCode.invalidVerificationCode (the code entered is expired or incorrect). Catch these explicitly in your sign-in logic:

let credential = PhoneAuthProvider.provider().credential(
    withVerificationID: verificationID, 
    verificationCode: verificationCode
)

Auth.auth().signIn(with: credential) { authResult, error in
    if let error = error as NSError? {
        switch AuthErrorCode(rawValue: error.code) {
        case .sessionExpired, .invalidVerificationCode:
            // Notify user and trigger resend flow
            self.showUserAlert(message: "验证码已过期，请获取新的验证码")
            self.resendVerificationCode()
        default:
            print("登录出错：\(error.localizedDescription)")
        }
        return
    }
    // Success: Proceed to post-login logic (e.g., navigate to home screen)
    self.goToHomeScreen()
}

Step 2: Build a Resend Verification Code Function #

Create a dedicated method to re-send the code. This will generate a new verificationID and send a fresh code to the user’s phone:

func resendVerificationCode() {
    guard let userPhone = self.phoneNumberTextField.text else {
        self.showUserAlert(message: "请确认手机号是否正确")
        return
    }
    
    PhoneAuthProvider.provider().verifyPhoneNumber(
        userPhone, 
        uiDelegate: nil
    ) { newVerificationID, error in
        if let error = error {
            self.showUserAlert(message: "重发失败：\(error.localizedDescription)")
            return
        }
        // Save the new verificationID for the next sign-in attempt
        self.verificationID = newVerificationID
        self.showUserAlert(message: "新验证码已发送至您的手机")
    }
}

Step 3: Polish User Experience #

To reduce confusion and make the flow smoother, add these small touches:

• Show a countdown timer (e.g., "验证码将在X秒后过期") when the first code is sent.
• Add a "Resend Code" button that’s disabled until the countdown finishes, then enables automatically.
• Clearly state the 5-minute validity window upfront when asking the user to enter their phone number.
• Limit resend attempts (e.g., max 3 times) to avoid hitting Firebase’s rate limits.

Quick Troubleshooting Tip #

If you’re still seeing unexpected expiration errors, double-check that you’re using the latest verificationID every time you generate a credential. It’s easy to accidentally reuse an old ID—make sure you overwrite it every time you send a new code.

内容的提问来源于stack exchange，提问作者Carlos Augusto