Identity Platform SMS Authentication Failure

[cameron123]

I'm using identity platform to log a user in with MFA. i'm using the javascript sdk and i can see the network request to v2/accounts/mfaSignIn:start fails with the error below. recaptcha seems to work fine and mfaSignIn:start includes the recaptcha token. an earlier call to v3/relyingparty/verifyPassword also works fine and uses the same API key and service. it just started happening today and has been on and off, so i don't think it's something on my end. Logs explorer in the Cloud Console doesn't show any more information about the error. The error is occuring across multiple projects and multiple organizations.

"The phone verification request contains an invalid application verifier. The reCAPTCHA token response is either invalid or expired."

[dionv]

Hello cameron123,

reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion. reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics.

Note: reCAPTCHA tokens expire after two minutes. If you're protecting an action with reCAPTCHA, make sure to call execute when the user takes the action rather than on page load.

[cameron123]

We are using firebase.auth.RecaptchaVerifier from firebase npm package 8.10.1. This depends on @firebase/auth 0.16.8. There are no dependencies on a recaptcha package. I see API calls to:

https://www.googleapis.com/identitytoolkit/v3/relyingparty/getRecaptchaParam
https://www.google.com/recaptcha/api2/reload
https://www.google.com/recaptcha/api2/userverify
https://www.google.com/recaptcha/api2/reload

It's the same API calls whether the SMS works or not. it's v2 of recaptcha, always. sometimes mfa works and sometimes it doesn't

[prashant90]

@cameron123have you got any solution for this? I am also getting the same error and same behaviour sometimes it works and sometimes doesn't

[cameron123]

no unfortunately not and it’s annoyingly intermittent. I recreated the problem again today so it’s still persisting for me.

Do you use a vpc service perimeter on your google project? I’m wondering if it’s related

[prashant90]

We are not using vpc service perimeter.