iOS Biometric Authentication Forces Logout Instead of Prompting on App Resume

Applies to: Mattermost Mobile 2.43.1 (iOS); Server 9.0 and later with Enterprise Advanced license

Symptoms: On iOS, after the Mattermost app backgrounds for more than 5 minutes with biometric authentication enabled, resuming the app shows a non-dismissable failure dialog instead of the Face ID or Touch ID prompt, and the only available action logs the user out entirely.

🛑 Problem

When a user resumes the Mattermost iOS app from the background after at least 5 minutes, the app triggers a biometric re-authentication check. Due to defects in the current release, the biometric prompt is never shown: the app instead immediately displays a blocking "Biometric or Passcode authentication failed" dialog. On a device with only one server configured, that dialog offers no retry or dismiss option - the sole available button is Logout, which destroys the session, removes stored credentials, and returns the user to the server URL entry screen.

This is a confirmed defect tracked as MM-70420. The fix is not included in 2.43.1, which is the latest release as of this writing.

This is not caused by session token expiry. The 5-minute background threshold is hardcoded and independent of session state. The session token is still valid when the app resumes - the logout is triggered entirely by the failure dialog, not by an expired token.

Symptoms

Users or administrators experiencing this issue will see:

Biometric or Passcode authentication failed.
[Logout]

The dialog is non-dismissable. Tapping Logout removes the session and all stored credentials for that server.

Additional symptoms:

• No Face ID or Touch ID prompt appears before the failure dialog
• Affected users report the issue triggers after any background period exceeding approximately 5 minutes, not only after extended inactivity
• Force-quitting the app and relaunching it presents the biometric prompt correctly and preserves the session
• Users with more than one server configured in the app may see a "Switch Server" option alongside Logout; single-server users see only Logout
• Cold-start behavior (after force-quit) is unaffected; the defect is specific to the background-resume path

✅ Solution

No patched release is available. Apply the workaround below until a fix ships in a future version of Mattermost Mobile.

Workaround: Force-Quit and Reopen the App

When the failure dialog appears, instruct affected users to:

1. Do not tap Logout.
2. Open the iOS app switcher (swipe up from the bottom or double-press Home).
3. Swipe the Mattermost app card upward to force-quit it.
4. Tap the Mattermost icon to reopen the app.

On relaunch, the app follows the cold-start path, which correctly presents the biometric prompt and preserves the existing session. Users do not need to re-enter the server URL or credentials.

⚠️ Important: Tapping the Logout button in the failure dialog is destructive. It removes the session, stored server URL, and credentials from the device. If users have already tapped Logout, they must re-enter the server URL and authenticate from scratch.

Additional Resources

For more information, see:

Mattermost Mobile Apps Documentation