Prevent iOS Consent Boxes for Auth0 React Native SDK and Allow MFA WebAuthn Biometrics as a First Factor

When using ephemeral sessions with the Auth0 React Native Software Development Kit (SDK) for iOS, the browser clears persistent cookies each time it closes. This prevents the use of features that rely on persistent cookies, such as MFA WebAuthn Biometrics as a first factor. To resolve this issue and avoid the iOS login and logout consent alert boxes triggered by ASWebAuthenticationSession, configure the application to use SFSafariViewController as the web provider.

• Auth0
• Auth0 React Native SDK for iOS
• Multi-Factor Authentication (MFA) WebAuthn Biometrics

Ephemeral sessions clear cookies upon closing, acting like a private window, causing features that rely on persistent cookies to fail. Additionally, ASWebAuthenticationSession accesses the shared cookie jar, prompting iOS to display login and logout consent alert boxes.

How can the iOS consent box be prevented while retaining persistent cookies?

Change the web provider in the Auth0 React Native application to SFSafariViewController to persist cookies without accessing the shared cookie jar.

1. Review the Auth0.swift User Agents documentation for a breakdown of ASWebAuthenticationSession versus SFSafariViewController.
2. Configure SFSafariViewController in the Auth0 React Native SDK by following the steps outlined in the React Native Auth0 FAQ.

NOTE: SFSafariViewController persists cookies, but does not share them outside the application. Because the application never accesses the shared cookie jar, iOS does not display the login and logout consent boxes, thereby allowing features that depend on persisted browser cookies to function correctly.