-
Notifications
You must be signed in to change notification settings - Fork 27
Description
Steps to Reproduce:
On an iOS device with biometrics disabled, attempt to create a passkey using the following publicKey options:
{
"rp": {
"name": "App name",
"id": "my_domain.com" // needs to be changed to the real domain name
},
"user": {
"id": "UjVIS0lNM1RNMjZCVkY2NzJGTFE",
"name": "my_name",
"displayName": "my_name"
},
"challenge": "5BpUi8A2tCj2bRzAnPlZ-Baxh93DG9qICl8Zs6ucDhASudblJxSVRjJX5B1GVEjZ8-2slxitdXLebMDkBon9Ww",
"pubKeyCredParams": [
{"type": "public-key", "alg": -7},
{"type": "public-key", "alg": -8},
{"type": "public-key", "alg": -36},
{"type": "public-key", "alg": -37},
{"type": "public-key", "alg": -38},
{"type": "public-key", "alg": -39},
{"type": "public-key", "alg": -257},
{"type": "public-key", "alg": -258},
{"type": "public-key", "alg": -259}
],
"timeout": 60000,
"authenticatorSelection": {
"requireResidentKey": false,
"userVerification": "preferred"
},
"extensions": {
"credProps": true
},
"attestation": "direct"
}
Expected Behavior:
Passkey should be created successfully using the device passcode (i.e., fallback to passcode-based auth if biometrics are unavailable). This works correctly in a web context when using navigator.credentials.create({ publicKey }).
Actual Behavior:
When using the react-native-passkeys library, passkey creation fails with the following error:
Error code: ERR_BIOMETRIC; error message: Calling the 'create' function has failed
The WebAuthn documentation states that it’s possible to create a passkey with biometrics disabled by setting:
authenticatorSelection: {
userVerification: 'preferred'
}
Other services (e.g., Binance) successfully create passkeys even when Face ID is disabled. In such cases, the user is prompted to enter the device passcode instead.
Environment:
- Device: iPhone 13
- iOS version: 18.5
- react-native-passkeys version: 0.3.3
- react-native: 0.76.9 (old architecture)
Question:
Is this a known issue? Are there any workarounds or recommended fixes to enable passkey creation via device passcode when biometrics are unavailable?