aws-amplify / aws-amplify/amplify-android

Cognito: cannot verify Email with link after updateUserAttributes()

Open
#1,105 6 comments 2 reactions 0 assignees View on GitHub
auth cognito feature-request
Dominant language
Java
Stars
287
Forks
132
Avg merge
2d 2h
Merged PRs (30d)
45

Description

Hi,

Background: we have a User Pool set up to verify the users both **phone numbers and emails**. The SMS template for phone number verification is the default template, while the email template is set to send a Link, instead of a Code. This seems fine following the documentation.

The problem: in our mobile app, when we sign up a user for the first time, we sign them up with the phone number only at first which triggers Cognito to send an SMS with the verification code. The app then captures the code and verifies it with Cognito. Once verified, the app then signs the user in and asks them for their email address and name. We send those to Cognito using the [updateUserAttributes()](https://docs.amplify.aws/lib/auth/user-attributes/q/platform/android#update-user-attribute) function. This update triggers Email verification but we receive a code in the email instead of the expected link configured in the User Pool's templates.

Upon further digging, we suspect that this behaviour is due to the API unconditionally calling the [GetUserAttributeVerificationCode()](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.html) API when updating the user's attributes.
So, whether this is a bug or a missing feature, could you please suggest a solution or add support to verifying emails with a link upon calling the updateUserAttributes() function?

Thank you.

Contributor guide

Open the contributing guide

Research direction

Start with updateUserAttributes() and the referenced GetUserAttributeVerificationCode() API behavior, then trace the Android authentication flow that handles email verification. Reproduce the phone-first signup and email update with a Cognito User Pool configured for link verification; done means the update flow supports the configured email link or clearly documents the limitation and its required alternative.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, aws, java
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.