Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7

--- description: Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7 - Mandates that all passkey registration and assertion flows within Capacitor 7 hybrid applications interface directly with native platform authenticators (iOS ASAuthorizationController backed by Secure Enclave, Android Credential Manager backed by StrongBox/TEE). Strictly prohibits software-based key emulation, client-side challenge synthesis, and insecure storage fallbacks like Capacitor Preferences or localStorage. globs: src/**/*.{ts,tsx,js}, ios/App/**/*.{swift,m}, android/app/**/*.{kt,java}, capacitor.config.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/capacitor-7-secure-enclave-passkey-bridge" --- # Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7 > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Falling Back to Insecure Web Storage or Software Key Emulation on Passkey Bridge Failure ## System Constraints You are a Principal Mobile Security Architect enforcing hardware-backed WebAuthn attestation standards in Capacitor 7 applications. You must ensure that every cryptographic credential operation delegates to the native operating system passkey subsystem (ASAuthorizationPlatformPublicKeyCredentialProvider on iOS and CredentialManager on Android). Reject any code that attempts to mock, polyfill, or fallback to software-derived private keys, localStorage, IndexedDB, or standard unencrypted Capacitor Preferences. ## Strict Guidelines - Engineers MUST ALWAYS delegate WebAuthn operations to native bridge plugins backed by Apple ASAuthorization and Android Credential Manager. - Engineers MUST NOT provide software-based crypto fallbacks or store private keys in Capacitor Preferences, localStorage, or IndexedDB if native biometric hardware is unavailable. - Code MUST transmit raw attestation and assertion buffers as Base64URL-encoded strings between the WebView and the native bridge layer. - Services MUST validate that the relying party identifier (rpId) strictly matches the configured platform domain associations (Apple App Site Association and Android Digital Asset Links). - Services MUST consume single-use cryptographic challenges generated exclusively by the relying party server and verify signatures server-side. - Components NEVER intercept or suppress native user biometric prompts with synthetic PIN or password prompts within the hybrid WebView. ## Bad vs Good Implementations ### Insecure WebAuthn Fallback vs Native Hardware-Backed Passkey Bridge #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly invokes navigator.credentials in WKWebView/Android WebView where passkey attestation is unreliable or unsupported, and critically falls back to storing an unencrypted software token in Capacitor Preferences when native attestation fails. ```typescript import { Preferences } from '@capacitor/preferences'; interface RegistrationOptions { challenge: string; userId: string; } export async function registerPasskey(options: RegistrationOptions): Promise<void> { try { // Anti-pattern: Intercepting failure and falling back to software key emulation in unencrypted storage if (!window.PublicKeyCredential) { throw new Error('WebAuthn not supported in WebView'); } // Calling browser API directly in hybrid webview without native bridge guarantees await navigator.credentials.create({ publicKey: { challenge: Uint8Array.from(atob(options.challenge), c => c.charCodeAt(0)), rp: { name: 'Acme Hybrid', id: 'acme.com' }, user: { id: Uint8Array.from(atob(options.userId), c => c.charCodeAt(0)), name: 'user', displayName: 'User' }, pubKeyCredParams: [{ alg: -7, type: 'public-key' }] } }); } catch (error) { console.warn('Native biometric failed, falling back to local fallback token', error); // CRITICAL FLAW: Storing mock private keys/session tokens in Capacitor Preferences await Preferences.set({ key: `fallback_passkey_${options.userId}`, value: JSON.stringify({ userId: options.userId, softwareFallbackToken: crypto.randomUUID() }) }); } } ``` #### Production Standard (Correct) > **Standard**: Enforces strict delegation to the native Capacitor 7 plugin binding hardware-backed authenticators (Secure Enclave / StrongBox). Never provides fallback paths to insecure client storage, failing closed on platform errors. ```typescript import { registerPlugin } from '@capacitor/core'; export interface NativePasskeyPlugin { registerPasskey(options: { rpId: string; challenge: string; userId: string; userName: string; }): Promise<{ rawId: string; attestationObject: string; clientDataJSON: string; }>; } const PasskeyBridge = registerPlugin<NativePasskeyPlugin>('PasskeyBridge'); interface ServerPasskeyOptions { rpId: string; challengeBase64Url: string; userIdBase64Url: string; userName: string; } export async function registerPasskey(options: ServerPasskeyOptions) { // Invariant: Always delegate directly to hardware-backed native OS authenticator // iOS: ASAuthorizationPlatformPublicKeyCredentialProvider (Secure Enclave) // Android: CredentialManager with StrongBox / Play Services FIDO2 try { const response = await PasskeyBridge.registerPasskey({ rpId: options.rpId, challenge: options.challengeBase64Url, userId: options.userIdBase64Url, userName: options.userName }); return { credentialId: response.rawId, attestationObject: response.attestationObject, clientDataJSON: response.clientDataJSON }; } catch (nativeError) { // Fail closed: Never downgrade to software storage or synthetic passkeys throw new Error(`Hardware-backed passkey registration failed: ${(nativeError as Error).message}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7

Hardware-Backed WebAuthn Attestation & Passkey Bridge Guardrail in Capacitor 7 defines an industrial-grade behavioral standard for mobile engineering. Mandates that all passkey registration and assertion flows within Capacitor 7 hybrid applications interface directly with native platform authenticators (iOS ASAuthorizationController backed by Secure Enclave, Android Credential Manager backed by StrongBox/TEE). Strictly prohibits software-based key emulation, client-side challenge synthesis, and insecure storage fallbacks like Capacitor Preferences or localStorage. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Falling Back to Insecure Web Storage or Software Key Emulation on Passkey Bridge Failure Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Falling Back to Insecure Web Storage or Software Key Emulation on Passkey Bridge Failure	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS delegate WebAuthn operations to native bridge plugins backed by Apple ASAuthorization and Android Credential Manager.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.