Add Biometric features

[Badisi]

Investigate if TouchID, FaceID, WebAuthn, etc. could add any value and how they could be implemented.

[ms-emp]

@Badisi

I had an idea as follows:

1. The first time the user visits the app, we redirect to login
2. At the identity provider we set the refresh token lifetime to 24 hours
3. When the app is resumed from the background we right away prompt the user for biometric
4. If successful, we check the current session, if expired, we try to do a silent refresh using the refresh token, once we have an active session we let the user in, if silent renew fails (the refresh token expired, meaning the user didn't use the app for more than 24 hours) we redirect to login

So as long as the user uses the app regularly (let's say once every 24 hours), the user doesn't have to re-enter his credentials.

[ms-emp]

@Badisi

I was considering implementing biometric login. My plan was to use a longed-lived refresh token, and when the user enables biometric login in the app, I will store the current user using UserManager.getUser under biometric storage. Then, when the user opens the app again and verifies with biometric, I would retrieve the user from the biometric storage and set that user using UserManager.storeUser and trigger a silent renew which will use the previously stored refresh token. However, these APIs are hidden when using ngx-auth.

Do you have any input on this flow, and can you think of a way of making these API's public?

[Badisi]

Using long-lived refresh_token can be risky in case they are stolen. To mitigate this you can use short-lived tokens and refresh token rotation which renew every token (ie. refresh, access and id tokens) every time.

And in any case, the library automatically store and renew the tokens for you, so you don't have to store and retrieve the user yourself.

[Badisi]

@ms-emp, thanks for the interest!

My reflection on the topic has evolved since I created this discussion, and I don't think adding biometrics to this library brings any additional value, nor that it has anything related to authentication (unless there are opinions to the contrary).

From my point of view, using FaceID/TouchID via the phone’s native APIs does not enhance authentication. To me, it’s simply an additional layer of security (like an extra door), and it doesn't fundamentally change the authentication already in place through the library.

Currently, tokens are already stored in a secure space on the phone, and the library already automatically renews these tokens before they expire. The maximum connection time for a user before they need to reconnect therefore depends on the combination of token lifetimes and the session duration itself. And it doesn't matter if the app is closed or reopened, user can still remain connected as long as a the session or token are active.

FaceID/TouchID only act as an additional security barrier and/or a facilitator to help the user reconnect (e.g., by storing the username/password and automatically re-injecting them in case of success).

Adding these features to the library, knowing that they wouldn’t be tied to any authentication flow, would merely expose the APIs of the associated plugins and would offer nothing more than if the developer directly imported those plugins themselves.

What do you think?