服务器端Firebase + PHP中的电话身份验证

When a user successfully authenticates with their phone number for the first time, the phone number is stored in the user's record in the Firebase Auth User list and can be considered verified.

Once a phone number is associated with a user in your Auth database, you can be sure that

• the phone number is valid
• the phone number has successfully been used to authenticate the user at the point in time the number has been associated with said user
• the phone number cannot be associated to another user

You should not assume that this phone number is now "verified". As stated in the official Firebase documentation pages:

Security concerns

Authentication using only a phone number, while convenient, is less secure than the other available methods, because possession of a phone number can be easily transferred between users. Also, on devices with multiple user profiles, any user that can receive SMS messages can sign in to an account using the device's phone number.

如果您在应用中使用基于电话号码的登录，则应将其与更安全的登录方法一起提供，并告知用户使用电话号码登录的安全权衡。

来源：https：//firebase.google.com/docs/auth/web/phone-auth#security-concerns

PS：向用户添加电话号码的唯一其他方法是通过Admin SDK，在这里，您有责任确保电话号码属于用户。

PSS：据我所知（并已检查），Firebase REST API不会公开“已验证的电话号码”信息。