Why are WebViews in mobile apps a challenge for passkeys?

Why are WebViews in mobile apps a challenge for passkeys?#

WebViews, often used in mobile apps to render web content, present unique challenges when implementing passkeys. These challenges stem from limited support for WebAuthn features within many WebView environments.

Key Challenges with WebViews for Passkeys#

1. Limited WebAuthn Support#

• Many WebViews lack full support for WebAuthn APIs, making it difficult to enable passkey functionality.
• Native browsers like Chrome or Safari are typically more passkey-ready than WebViews. Alternatively, a native implementation of passkeys in the iOS or Android app is possible.

2. Inconsistent Implementations#

WebView capabilities vary by platform and version:

• WKWebView on iOS offers better support but may still lack key WebAuthn features.
• Android WebView implementations are often less consistent and may require custom configurations.

3. Security Constraints#

• WebViews often have restricted environments that limit access to the local authenticator, such as Face ID, Touch ID or the Android biometric equivalent.
• This can prevent seamless passkey creation or usage within the app.

4. User Experience Issues#

If passkeys don’t work within WebViews, users may need to switch to an external browser or app for authentication, disrupting the login flow. Usually, the best passkey UX can be achieved when using the native implementation of passkeys in the respective iOS or Android app development framework (e.g. Kotlin, Swift)

Strategies to Address WebView Challenges#

1. Test WebView Compatibility:
   • Use data from State of Passkeys to identify WebView limitations.
   • Evaluate the specific WebView types (e.g., WKWebView vs. Android WebView) used in your app.

2. Fallback Options:

   • Redirect users to native browsers for authentication if WebView support is insufficient.
   • Maintain alternate MFA methods during the transition phase.

3. Encourage Native Implementation: Where possible, use native app components for passkey functionality instead of relying on WebViews.

4. Work with Vendors: Collaborate with WebView and platform providers to advocate for better WebAuthn support in future updates.

Conclusion#

WebViews pose significant challenges for passkeys due to limited WebAuthn support and security constraints. By understanding these limitations and implementing strategies like fallback options and native app components, you can ensure a smoother passkey rollout.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →