MetaMask / MetaMask/metamask-mobile

Unable to use the WebAuthn API from MetaMask browser

Open
#4,974 8 comments 0 reactions 0 assignees View on GitHub
browser needs-product type-enhancement
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

**Describe the bug**
The MetaMask browser extension does not seem to support the [WebAuthn](https://webauthn.guide/). WebAuthn is currently supported on Chrome, Firefox, Edge, and Safari and enables authentication using public key cryptography.

Impact: this blocks certain authentication flows from taking place inside the MetaMask browser. For example, it's difficult to support an experience related to minting an NFT linked to a specific public key tied to a chip.

**To Reproduce**
1. In a MetaMask browser tab navigate to https://webauthn.io/ (a WebAuthn demo site)
2. Enter "test" in the field "example_username"
3. Tap "Register"
4. Unexpected behavior: Nothing happens

**Expected behavior**
After clicking "Register", we expect to see a popup prompting the user to allow "webauthn.io" to use Face ID. You can repro this on a Chrome browser to see the expected behavior.

**Smartphone (please complete the following information):**
- Device: iPhone 13 Pro
- OS: iOS 15.6.1
- App Version: 5.6.0

-------------------------------------------------------------
_to be added after bug submission by internal support / PM_
**Severity**

- How critical is the impact of this bug on a user?
- Add stats if available on % of customers impacted
- Is this visible to all users?
- Is this tech debt?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the steps on the specified iPhone and iOS version, then trace how the MetaMask mobile browser handles WebAuthn registration and platform authentication. Compare the behavior with Chrome. Done means registering on webauthn.io opens the expected Face ID permission prompt and completes the flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, react-native, typescript
Domain
authentication, mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.