public enum UnlockPolicy
- Object
- Enum<UnlockPolicy>
- UnlockPolicy
ImplementsComparable<UnlockPolicy>
How a vault may be reopened, chosen by the application and explained to the user.
This is the trade an application actually has to make, so it is a choice of three named behaviours rather than a set of cryptographic parameters. What changes between them is which wraps of the data key are allowed to exist on this device – and the rule that makes the strongest one mean anything is that choosing it removes the weaker wraps rather than leaving them beside it. A vault that requires a passkey and also keeps an unattended device wrap is a vault that does not require a passkey.
Enum constants
SESSION_ONLY | The password is required every time the application starts, or in a browser every time the page loads. |
REMEMBER_DEVICE | The user chose to be remembered on this device. |
REQUIRE_USER_VERIFICATION | The device key exists but reaching it requires the user to verify themselves – a biometric, a device passcode, a passkey with user verification. |
Methods
public static UnlockPolicy[] values() | |
public static UnlockPolicy valueOf(String name) |
Inherited methods
Enum constant details
SESSION_ONLY
SESSION_ONLYThe password is required every time the application starts, or in a browser every time the page loads.
Nothing that can reopen the vault is written to the device: the data key exists only in memory between unlock and lock. The strongest of the three against a stolen device or a copied browser profile, and the one users abandon, which is why it is not the default for anything.
REMEMBER_DEVICE
REMEMBER_DEVICEThe user chose to be remembered on this device.
The data key is additionally wrapped under a device key – the OS key store on a native
port, a non-extractable CryptoKey in the browser – so the vault reopens without a
prompt. That is unattended access by design: anyone who can run the application on this
device, or who copies a full browser profile including its IndexedDB, reopens the vault
without knowing the password.
An application offering this must say so in those words. “Remember me” reads as a convenience and is a change in who can read the data.
REQUIRE_USER_VERIFICATION
REQUIRE_USER_VERIFICATIONThe device key exists but reaching it requires the user to verify themselves – a biometric, a device passcode, a passkey with user verification.
Choosing this deletes any REMEMBER_DEVICE wrap that already existed, and refuses to
create one while it is in force. Without that, the unattended wrap sits beside the gated
one and the prompt is decoration.
Not every platform can provide it. Vault.capabilities() reports whether this device can,
and Vault.enroll fails with VaultError.POLICY_NOT_MET rather than quietly enrolling
under a weaker policy.
Method details
values
public static UnlockPolicy[] values()valueOf
public static UnlockPolicy valueOf(String name)