Expo-在Android 8.1.0上重新安装App后访问Keystore时出错

Question

When we uninstall and re-install our standalone app, we're getting the following exception thrown in the logs when we try to access the Android Keystore again via Expo.SecureStore:

10-12 15:56:37.716  1793  1887 I ReactNativeJS: { [Error: Could not decrypt the item in SecureStore]
10-12 15:56:37.716  1793  1887 I ReactNativeJS:   framesToPop: 1,
10-12 15:56:37.716  1793  1887 I ReactNativeJS:   code: 'E_SECURESTORE_DECRYPT_ERROR',
10-12 15:56:37.716  1793  1887 I ReactNativeJS:   line: 148,
10-12 15:56:37.716  1793  1887 I ReactNativeJS:   column: 1889,
10-12 15:56:37.716  1793  1887 I ReactNativeJS:   sourceURL: '/data/user/0/com.trinet.mobilev7/files/30.0.0/cached-bundle-experience-%40trinet%2Fmobilev7-737969915-30.0.0' }

The current workaround is to go into Device Settings > Apps & Notifications > See All Apps > Our App > Clear Data. However, we require our device UUID to be cached in the Keystore (we're using to identify devices in our backend for our Push Notification service) so that it persists between re-installations. This works fine on other versions of Android (and also iOS) except 8.1.0.

The following devices are giving errors:

• Nexus 5X
• Samsung S9
• Xiaomi

Is there any fix that can be done using the Expo SDK to fix this or will we have to wait till the next version of Expo for a fix?

Answer 1

I looked at the AOSP source. AFAICT the code to remove the keystore entries associated with an app when that app is removed has been there since ~2013 (which is around when Android started providing the keystore service). See the method removeKeystoreDataIfNeeded() in PackageManagerService .

Just common sense wise, it doesn't make much sense to retain keystore entries created by an app when that app is removed.

we require our device UUID to be cached in the Keystore

Android is constantly making improvements to prevent apps from doing just that. As a regular app, you should not be able to track a device across installs of your app. You should not be able, and ethically you should not try. A user has the right to "be forgotten" by your app if they uninstall your app. If you want to re-associate your app your system should have some sort of login that makes it an explicit choice by the user to re-associate with your system. You can read more about that here: https://developer.android.com/training/articles/user-data-ids

Answer 2

Try clearing residual data on your mobile device. Mist probably you have stored something by running your app and it isn't cleared at the time of uninstall.

Clear not just cache, but residual data as well.

Hope this helps. :)