CODEWITHSUNDEEP
androidandroid-biometric-prompt
AndyShoes
AndyShoes

Reputation: 43

How to handle the biometric prompt after lockout error?

i'm using the biometric prompt in order to authenticate clients on my app. The problem i'm getting is this: after i use a wrong fingerprint for 5 times, i get the ERR_LOCKOUT that locks the API for 30 seconds. After that, i get the lockout error for all the time, even if i'm just trying to create the biometric prompt info without using the finger to authenticate. How can i make the app more stable? Do i need to use an handler for those 30 seconds or is there another way?

P.S: After i get the error i use the authentication cancelled callback and return an error

Upvotes: 3

Views: 5261

Answers (2)

LethalMaus
LethalMaus

Reputation: 956

Some devices handle this differently that what the comment suggests. Some phones lockout up to 4 hours while other e.g. Pixel 6, lockout until some action is performed.

This is what my Pixel 6 says:

Too many attempts. Use screen lock instead.

Which means I have to prompt the user to lock and unlock their screen before they can retry, so the 30 seconds doesnt apply here.

In the BiometricPrompt.AuthenticationCallback when onAuthenticationError(errorCode: Int, errString: CharSequence) is called, you can see the message that the system delivers. Be wary though, not every device sends an ideal translated message to the user, so handling the message yourself as well as delivering the message is advised

Upvotes: 0

Isai Damier
Isai Damier

Reputation: 984

Are you following the recommendations laid out in the blog posts blogPost1 & blogPost2? If not, the recommendation is to follow those patterns. With regards to ERROR_LOCKOUT the doc reads

/**
 * The operation was canceled because the API is locked out due to too many attempts.
 * This occurs after 5 failed attempts, and lasts for 30 seconds.
 */
int ERROR_LOCKOUT = 7;

There are many ways you can handle this in your code:

  1. You can tell the user to try again in 30 seconds
  2. Or you can gray out the button and tell user to try again in 30 seconds -- and then after 30 seconds re-enable the button.

And to be exact you should only be getting this error when you call authenticate() and not when you try to create PromptInfo.

Upvotes: 3

Related Questions