- Twilio Cookbook(Second Edition)
- Roger Stringer
- 565字
- 2021-07-16 12:06:34
Adding two-factor voice authentication to verify users
Being able to verify that the users are actual users, and being able to help them have better security, is an important factor for everyone, and that's where two-factor authentication comes in handy.
Two-factor authentication is a more secure way of logging in to a website. In addition to entering a password online, a user has to enter a random verification code generated at login time. This combination of passwords makes it easier to safeguard your applications.
Two-factor authentication is used in:
- E-commerce sites
- Sites that allow users to sign up
- Recovering lost passwords (by sending the new code to a phone number already saved)
More and more big web services are starting to activate two-factor authentication as they realize how important it can be. Amazon, Google, and Apple are just some of the companies that have begun utilizing two-factor authentication for user protection.
Getting ready
The complete source code for this recipe can be found in at Chapter1/Recipe1
.
How to do it...
We're going to build our first Twilio app, a two-factor voice authentication system. This can be plugged into websites to allow users to get called on a phone and verify whether they are who they say they are. Perform the following steps:
- Download the Twilio Helper Library (from https://github.com/twilio/twilio-php/zipball/master) and unzip it.
- Upload the
Services/
folder to your website. - Upload
config.php
to your website and make sure the following variables are set:<?php $accountsid = ''; // YOUR TWILIO ACCOUNT SID $authtoken = ''; // YOUR TWILIO AUTH TOKEN $fromNumber = ''; // PHONE NUMBER CALLS WILL COME FROM ?>
This file will let you configure your web app with your Twilio account information.
- We'll set up a file called
two-factor-voice.php
, which will sit on your web server. This file handles the two-factor authentication:<?php session_start(); include 'Services/Twilio.php'; include 'config.php'; include 'functions.php'; $username = cleanVar('username'); $password = cleanVar('password'); $phoneNum = cleanVar('phone_number'); if( isset($_POST['action']) ){ if( isset($_POST['username']) &&isset($_POST['phone_number'])){ $message = user_generate_token($username,$phoneNum,'calls'); }else if( isset($_POST['username']) &&isset($_POST['password']) ){ $message = user_login($username, $password); } header("Location: two-factor-voice.php?message=" .urlencode($message)); exit; } ?> <html> <body> <p>Please enter a username, and a phone number you can bereached at, we will then call you with your one-timepassword</p> <span id="message"> <?php echo cleanVar('message'); $action = (isset($_SESSION['password'])) ? 'login' :'token'; ?> </span> <form id="reset-form" method="POST" class="center"> <input type="hidden" name="action" value="<?php echo$action;?>" /> <p>Username: <input type="text" name="username"id="username"value="<?php echo $_SESSION['username']; ?>" /></p> <?php if (isset($_SESSION['password'])) { ?> <p>Password: <input type="password" name="password"id="password" /></p> <?php } else { ?> <p>Phone Number: <input type="text" name="phone_number"id="phone_number" /></p> <input type="hidden" name="method" value="voice" /> <?php } ?> <p><input type="submit" name="submit" id="submit"value="login!"/></p> <p> </p> </form> </body> </html>
You may notice one of the functions we called is
cleanVar()
; this is a little function I like to use to make sure certain variables, specifically usernames, passwords, and phone numbers, follow a set rule. - Finally, create a file called
functions.php
on your web server:<?php function cleanVar($key){ $retVal = ''; $retVal = isset( $_REQUEST[$key]) ?$_REQUEST[$key] : ''; switch($key){ case 'username': case 'password': $retVal = preg_replace("/[^A-Za-z0-9]/","", $retVal); break; case 'phone_number': $retVal = preg_replace("/[^0-9]/", "", $retVal); break; case 'message': $retVal = urldecode($retVal); $retVal = preg_replace("/[^A-Za-z0-9 ,']/","", $retVal); } return $retVal; } function user_generate_token($username, $phoneNum,$method='calls'){ global $accountsid, $authtoken, $fromNumber; $password = substr(md5(time().rand(0, 10^10)), 0, 10); $_SESSION['username'] = $username; $_SESSION['password'] = $password; $client = new Services_Twilio($accountsid, $authtoken); $content = "Your newly generated passwordis ".$password."To repeat that, your passwordis ".$password; $item = $client->account->$method->create( $fromNumber, $phoneNum, $content ); $message = "A new password has been generated and sentto your phone number."; return $message; } function user_login($username, $submitted) { // Retrieve the stored password $stored = $_SESSION['password']; // Compare the retrieved vs the stored password if ($stored == $submitted) { $message = "Hello and welcome back $username"; }else { $message = "Sorry, that's an invalid username andpassword combination."; } // Clean up after ourselves unset($_SESSION['username']); unset($_SESSION['password']); return $message; } ?>
How it works...
In steps 1 and 2, we downloaded and installed the Twilio Helper Library for PHP; this library is the heart of your Twilio-powered apps.
In step 3, we uploaded config.php
that contains our authentication information to talk to Twilio's API.
When your users go to two-factor-voice.php
, they are presented with a form where they enter a username and their phone number. Once they submit the form, it generates a one-time usage password and sends it as a text message to the phone number they entered. They then enter this password in the form on the site to verify that they are who they say they are.
I've used this on several different types of websites; it's a feature that people always want in some way to help verify that your users are who they say they are.
- 物聯網與北斗應用
- 5G承載網網絡規劃與組網設計
- 物聯網安全與深度學習技術
- Hands-On Full Stack Development with Spring Boot 2 and React(Second Edition)
- 互聯網安全的40個智慧洞見:2015年中國互聯網安全大會文集
- 2018網信發展報告
- 計算機網絡原理與應用技術
- 電力物聯網工程技術原理與應用
- INSTANT KineticJS Starter
- SAE原理與網絡規劃
- Getting Started with Memcached
- 一本書讀懂物聯網
- Enterprise ApplicationDevelopment with Ext JSand Spring
- 物聯網與智慧廣電
- SEO攻略:搜索引擎優化策略與實戰案例詳解