Firebase Phone Authenticate重发验证码：能否发送同一验证码？

Great question—this is a super common edge case with phone authentication flows, so let’s break down what’s possible here.

Firebase's Default Behavior & Built-in Settings #

First things first: Firebase Phone Authentication doesn’t have a native setting to force resending the same verification code. By design, every time you call the signInWithPhoneNumber() JavaScript method to request a code, Firebase generates a brand-new, unique code tied to a fresh verificationId. This is a deliberate security choice to limit how long a compromised code could be used to gain access.

There’s no toggle in the Firebase Console or official API parameter to bypass this—Firebase prioritizes security here, so this hardcoded behavior can’t be overridden directly.

Can You Implement This with the JavaScript API? #

Yes, but it requires adding custom logic on your end (since Firebase won’t handle this for you). Here’s a practical approach:

1. Cache the initial verification data
   When the user first requests a code, store the verificationId returned by signInWithPhoneNumber() (note: Firebase doesn’t expose the actual code to client-side JS, so if you want to re-send the exact code, you’ll need to use a custom SMS provider like Twilio instead of Firebase’s built-in SMS delivery to access the code content).

2. Override the "Resend" button logic
   When the user clicks "Resend" before receiving the first code:

   • Check if there’s an unexpired verificationId in your cache (local storage, state management, or your backend).
   • Instead of calling signInWithPhoneNumber() again (which would generate a new code/ID), either:
     • Notify the user to wait for the original code (the simplest, most secure approach), or
     • If you’re using a custom SMS provider, re-send the exact same initial code tied to the existing verificationId.

   Critical note: Even if you re-send the same code, it will only work with the original verificationId. Generate a new ID, and the old code becomes invalid—so the key is to avoid triggering a new Firebase auth request on resend.

3. Mitigate Security Risks
   Since reusing codes weakens security, balance this with safeguards:

   • Shorten the code’s expiration window: In the Firebase Console, go to Authentication > Sign-in method > Phone > Advanced to set a shorter validity period (minimum 1 minute, maximum 60 minutes).
   • Add rate limiting to your resend functionality to prevent abuse.

Final Takeaway #

Firebase doesn’t support this out of the box, but you can build a workaround with custom caching and (optionally) a custom SMS provider. Just make sure you weigh the user experience benefit against the security tradeoff before rolling this out.

内容的提问来源于stack exchange，提问作者vovan