This is my first project related to SMS verification.

How to implement SMS verification in online ordering web application? For example:- when we try to reset the password in amazon's website, it sends an sms verification code and after entering the code it proceeds with changing the password. I want to implement the same function in my application, where users will place order, but before the final step it will send an sms verification code to the users mobile and verify the same.

The main requirement is SMS Gateway(Transactional Quality).

But as I'm completely new in this, so any idea how to proceed, or how can I implement it.

  • Hi, programmers if for questions regarding concepts, theoretical stuff and other things that you can check here: programmers.stackexchange.com/help/on-topic for your question I recommend you to post it in stackoverflow.com – jsedano Jul 25 '13 at 14:31
  • I think this would probably be best suited for Stack Overflow, but I just happen to have an answer. – Michael Brown Jul 25 '13 at 14:48
  • stackoverflow. Might delete this question, because they expect some code to demonstrate they problem, minimum amount of problem solving ..But @MikeBrown if you have an answer please share – Trying Tobemyself Rahul Jul 25 '13 at 14:50
  • Sharing your research helps everyone. Tell us what you've tried and why it didn’t meet your needs. This demonstrates that you’ve taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Jul 25 '13 at 15:11
  • @gnat I'm completely new on this topic. I did try searching, from that I came to know that the basic requirement is SMS gateway, but my problem is how to implement it, using AJAX to call the php script to send the sms or any other way. – Trying Tobemyself Rahul Jul 25 '13 at 15:28

You don't need AJAX or anything other than using POST commands over a secure channel.

At a very high level these are the steps:

Step 1 - The signup page.

Utilize https for any signup pages that include sensitive information. Because the user will be sending their e-mail address and phone number this must be https.

  1. Post the account information including the phone number in which the SMS should be sent to.
  2. Create a random verification code
  3. Store the verification code along with the new account sign up information
  4. Send the SMS message with only the verification code

Then redirect the user to the verification page. This page only needs to accept the verification code. Remember that all you are doing is ensuring that the person that has access to the phone is also the same person with the account information. You can't stop someone from being malicious if they have someone else's phone. The phone is called "Something you have" in security terms.

Step 2 - The verification page

  1. Post the verification code. This assumes you are using any one of the number technologies that tracks state through session ids.
  2. Look up the account id in memory using the current session. This information should already be readily available. Then confirm that the verification code is the same one that is stored in the database. This isn't a password so I don't see a reason to hash this information. It's a one-user throw away code. It doesn't matter if someone else gets it later.
  3. If the verification code matches mark the user as verified. Now you know that this account has access to a specific phone number.

I've included a rudimentary diagram for reference.

enter image description here

  • The answer is perfect, but in your method users data is saved in the database before it gets verified, but I don't want that to happen, I want to save the user only after verification.what if I don't want to change the page for verification, instead I want to show a popup to verify the user – Trying Tobemyself Rahul Jul 25 '13 at 16:14
  • @TryingTobemyselfRahul You do not have to save it in the same location as the verified accounts. The idea is some persistent storage to verify the code. What happens if the user closes that page? Do they have to go through everything again? If so, then just store the association in memory on the back-end. You can also use JQuery and AJAX to to popup a window to verify the code. However, the storage of the code to the user and the verification process has to be on the back-end or else someone can easily hi-jack these operations. The step that says yes or no should be on the server side. – Andrew T Finnell Jul 25 '13 at 16:27
  • Got it..thanks...so if i put my verification and sms sending code in the backend and use ajax to do the talking between the client and server to verify, then its ok na..? – Trying Tobemyself Rahul Jul 25 '13 at 16:31
  • 1
    @TryingTobemyselfRahul Yes exactly. But like I said anything that contains sensitive information should be sent through HTTPS. While HTTPS doesn't stop all types of attacks it is infinitely better than HTTP. What you are trying to stop is someone doing a packet-sniff somewhere in the routing and hijacking the conversation. – Andrew T Finnell Jul 25 '13 at 16:34
  • ok. Thanks, Andrew Finnell. You deserve a treat from me. ;) – Trying Tobemyself Rahul Jul 25 '13 at 16:37

There are a number of cloud hosted SMS gateways, with a very simple api that you can implement your solution using. Twilio is the first that comes to mind, but there are others as well if you do a quick search for SMS Cloud API.

What's cool about twilio is that it also has a voice API with Text to Speech capabilities. So you can send an SMS or initiate a phone call with just a little change in code.

  • Thanks for the info..But the problem is how to get started, suppose i registered at twilio, and i sent the verification code, should i use ajax here or server side notifiation, which is the best way – Trying Tobemyself Rahul Jul 25 '13 at 14:59
  • What programming language are you using? You shouldn't use ajax because a malicious user would be able to manipulate the JS and send all kinds of messages on your company's behalf. – Michael Brown Jul 25 '13 at 15:02
  • i'm using php(laravel 4 framework), what will the best way to do it – Trying Tobemyself Rahul Jul 25 '13 at 15:25
  • Can USSD messages be used for Verification? – Trying Tobemyself Rahul Jul 25 '13 at 15:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.