How to Implement Production-Ready Biometric Auth in Expo Mobile Apps

·1 views

A technical guide from DEV Community outlines how to correctly integrate biometric authentication — such as Face ID and fingerprint — into Expo-based mobile apps. Developers are advised to first detect device capability at runtime, distinguishing between no hardware support, unenrolled hardware, and fully ready states, each requiring its own UI response. The guide stresses that biometrics should only be enabled after explicit user consent, recorded in hardware-backed secure storage rather than plain async storage, to protect sensitive auth tokens. Key pitfalls include leaving biometric-unlockable tokens active after a user disables the feature, and using device-specific labels like 'Face ID' on incompatible hardware. Handling every fallback scenario — not just the happy path — is what separates a demo implementation from a shippable, secure feature.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AgenticJobs Bug Let Anyone Hijack Accounts via Magic Link Rendered in Browser

A security flaw in the AgenticJobs job board platform allowed any visitor to obtain a valid magic-link sign-in for any email address they typed, without owning that address. The bug stemmed from an SMTP configuration field that was declared in code but never backed by an actual mail-sending library, meaning the app always fell through to a dev-only fallback that rendered the login link directly in the browser. Because the magic-link endpoint also auto-created accounts, an attacker could silently take over or create any account with no prior access required. The issue was discovered accidentally when a Resend API call rejected a test address, prompting a closer audit of the authentication flow. Version 0.3.0 patches the flaw by wiring up real email delivery via Resend, ensuring credentials never appear in a browser response under any circumstances.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Trading Agent Sets Stop-Loss in 44 Seconds, Then Goes Absent for the Full Session

An AI trading agent known as 'Afu', running on the open-source DuDuClaw platform, completed its entire pre-market analysis for Day 22 of a 30-day experiment within just 44 seconds on the morning of that trading day. The agent correctly recalculated a stop-loss for ETF 00919 at 32.06, a task it had missed the previous day, by simply reapplying its standard formula to the latest closing price. However, scheduled mid-session monitoring checks at 10:30 a.m. and 12:30 p.m. produced no log entries, meaning the agent was effectively absent throughout the trading session. The ETF closed at 32.58, never approaching the stop-loss threshold, so the lack of oversight had no immediate financial consequence. The experiment highlights a key gap in the agent's design: it can execute a disciplined pre-market routine but has so far failed to sustain that discipline across a full trading day.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Browser Reaction Tests Vary and How to Get Consistent Results

Browser-based reaction time tests are affected by factors like display refresh rate, input latency, and device setup, making single results unreliable. Experts suggest focusing on personal performance trends rather than treating any one score as a definitive measure of reaction speed. To improve consistency, users should stick to the same device, browser, and input method across multiple test sessions and compare median scores over time. A free tool called ReflexPeak has been built around this philosophy, offering browser-based reaction, memory, and focus tests that store results locally for personal benchmarking. The key takeaway is that such tools are best used as personal performance exercises, not as medical or neurological assessments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shadow Agent Problem: Why AI Agents Need Action-Layer Governance

As AI agents become more common in enterprise environments, developers can deploy them using personal API keys with access to sensitive internal tools — often without security reviews or centralized oversight. Unlike traditional Shadow IT, these agents do not merely access data; they can autonomously trigger payments, modify infrastructure, and automate decisions at machine speed. Existing identity and access management controls address who can connect to systems but fail to evaluate whether a specific action should be permitted in real time. Experts argue that governance must shift to the execution layer, where a policy engine intercepts and evaluates every high-impact action before it takes effect. This architectural approach removes the need to catalog every agent in advance, instead focusing oversight on the actions agents perform.

0 comments Read more at DEV Community