CODEWITHSUNDEEP
androidiosmobilebiometricsface-id
Flama
Flama

Reputation: 868

How do apps properly validate Face-id or biometrics before important actions on the backend?

I have a theoretical question, how is a mobile app supposed to handle Face-id or biometrics being required before certain task.

Let's say a banking app asks for Face ID on iPhone before making a transaction. How is the backend supposed to validate it? What is the backend supposed to get? Some sort of token? Can you provide me with any implementation guidelines on that?

Update: I get that the backend does not validate it. But what is the security standard in that case, reauthenticate the user?

Upvotes: 0

Views: 282

Answers (1)

Gary Archer
Gary Archer

Reputation: 29291

AUTHENTICATION

You could take a look at passkeys and the WebAuthn standard, where:

  • The main credential sent to the server is a digital signature produced with strong asymmetric cryptography.
  • The use of FaceID etc is a secondary authentication factor, mostly just to prove user presence and to help prevent automated attacks.

API ACCESS

Although a digital signature proves that the user authenticated, it can be useful if, after authentication, the app can also get an API credential for a high privilege business area.

Eg a banking app using OAuth 2.0 might operate like this:

  • The app triggers re-authentication with a parameter like scope=payments.
  • The authorization server presents passkey login forms to authenticate the user.
  • The authorization server issues an access token with the requested scope - and perhaps a level_of_assurance claim representing the user's authentication strength.
  • The API then has what it needs to decide whether to allow the high privilege operation.

SUMMARY

So there are a couple of backend concerns that you might separate:

  • Server side validation to verify a proof of the user identity
  • High privilege resource access afterwards

Upvotes: 1

Related Questions