App gracefully handles permission denials
Why it matters
A permission denial is a user's explicit choice to restrict access — an app that crashes in response to that choice punishes the user for exercising their privacy preference. This is both a UX failure and a reliability issue captured by CWE-391 (Unchecked Error Condition) and ISO 25010 reliability fault-tolerance requirements. On iOS, once a user denies a permission, the native dialog never appears again — the app must handle the BLOCKED state and guide the user to Settings. An app that shows a generic error message with no Settings deep-link leaves the user with no path forward. The pattern of crashing on denial also causes 1-star reviews specifically citing privacy concerns, compounding the trust damage.
Severity rationale
Medium because permission-denial crashes create immediate user-facing failures and, for users exercising GDPR consent withdrawal, punish a legally protected user action with an application crash.
Remediation
Handle all three permission states — GRANTED, DENIED, BLOCKED — for every permission-gated feature. For BLOCKED state, always provide a direct Settings deep-link.
import { request, check, PERMISSIONS, RESULTS, openSettings } from 'react-native-permissions'
async function activateCameraFeature() {
const status = await check(
Platform.OS === 'ios' ? PERMISSIONS.IOS.CAMERA : PERMISSIONS.ANDROID.CAMERA
)
switch (status) {
case RESULTS.GRANTED:
startCamera()
break
case RESULTS.DENIED:
const result = await request(
Platform.OS === 'ios' ? PERMISSIONS.IOS.CAMERA : PERMISSIONS.ANDROID.CAMERA
)
if (result === RESULTS.GRANTED) startCamera()
break
case RESULTS.BLOCKED:
Alert.alert(
'Camera Access Required',
'Camera access was denied. Open Settings to enable it.',
[{ text: 'Open Settings', onPress: openSettings }, { text: 'Cancel' }]
)
break
default:
// Feature unavailable — disable UI element, do not crash
setFeatureAvailable(false)
}
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Permissions & Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-391 — Unchecked Error Condition
- iso-25010:2011 · reliability.fault-tolerance — Fault Tolerance
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-permissions-privacy·automated