CODEWITHSUNDEEP
reactjsdjango-rest-frameworkoauthbiometricsdjango-oauth-toolkit
Dash Winterson
Dash Winterson

Reputation: 1295

How to use biometrics with an existing OAuth system

My mobile app has this (fairly common) authentication user experience:

  1. user signs in with email and password
  2. user is prompted to enable biometrics for faster access next time
  3. when user returns to app after a time of inactivity
    1. if they enabled biometrics, they are given the biometric challenge and then granted full access to the app
    2. if they did not enable biometrics, they need to log in again with email and password
  4. if user chooses to explicitly log out, then next time they are treated as a new user (go to point 1)

I'm stuck on how to securely implement step 3.1.

My app is written in React Native and using react-native-biometrics and our backend is using django-oauth-toolkit and django rest framework. There's a diagram in the docs illustrating the intended use, but to briefly summarise:

  1. When enabling biometrics, app generates a key pair on device
  2. App registers the public key with the backend
  3. When a user returns to the app, app prompts for biometrics
  4. App sends a signed payload to the backend
  5. Backend verifies signature using stored public key

So far so good, but what happens next? Once the user has successfully passed biometric authentication, how to I make them signed in on the device? I had thought of storing the user's refresh token on the server and returning that in point 5 above, but that amounts to storing unhashed credentials on the server, which is obviously not OK.

Am I thinking about this right? Do I need to find some way to mint a new access/refresh token?

Upvotes: 0

Views: 35

Answers (0)

Related Questions