Questions tagged [webauthn]

Browser API implementing the Web Authentication standard. Credentials are stored on (local) authenticators which use and are accessed using strong cryptography.

See Web Authentication: A Web API for accessing scoped credentials:

This specification defines an API that enables web pages to access WebAuthn compliant strong cryptographic credentials through browser script. Conceptually, one or more credentials are stored on an authenticator, and each credential is scoped to a single Relying Party. Authenticators are responsible for ensuring that no operation is performed without the user’s consent. The user agent mediates access to credentials in order to preserve user privacy. Authenticators use attestation to provide cryptographic proof of their properties to the relying party. This specification also describes a functional model of a WebAuthn compliant authenticator, including its signature and attestation functionality.

303 questions
0
votes
1 answer

Keycloak with W3C Web Authentication(webAuthn) support for password-less authentication does not work on iOS

We are currently using Keycloak 12.0.0 Passwordless login/authentication feature backed by W3C Web Authentication (webAuthn for password-less authentication). We have bootstrapped an Identity Server using the same Authentication/Authorization…
0
votes
1 answer

WebAuthn: Login not possible on subdomain

I have an Angular 11 (Frontend) and Kotlin (Backend) Project where I have implemented a WebAuthn Login. The registration of works straightforward, I get a challenge from the (WebAuthn4J) Backend and create the credentials with this: ... const…
PrimuS
  • 2,505
  • 6
  • 33
  • 66
0
votes
1 answer

WebAuthn Relaying Party ID for various Setups

I have an Angular 11 Project, which implements a WebAuthn registration. The backend is SpringBoot 2.4 WebAuthn Login should work in two parts of the project, the "main" and the "viewer" The domain setup is rather complicated: Main…
PrimuS
  • 2,505
  • 6
  • 33
  • 66
0
votes
1 answer

Implement face authentication in React App

I wanted to create a React Application that could be unlocked via Face Authentication similar to Windows Hello. How does face authentication work? How can I make this work? Many android applications and iOS applications already have this…
KillMe
  • 184
  • 5
  • 20
0
votes
0 answers

Webauthn with Face ID and Touch ID

Recently there is the possibility to verify a login with FaceID or TouchID. This is explained here https://developer.apple.com/videos/play/wwdc2020/10670/. Currently I can't find complete sample codes, but…
Maisen1886
  • 110
  • 1
  • 10
0
votes
1 answer

After importing firebase in app.js I initialized but in controller firebase.auth.createUserWithEmailAndPassword is not a function

This is in my app.js where I import firebase and initialized it const firebase = require('firebase'); firebase.initializeApp({ apiKey: ************, authDomain: ****************, databaseURL: **********", projectId:…
0
votes
2 answers

How to retrieve public key from attestationObject in java

I am getting attestationObject: ArrayBuffer(648) from registartion process. I want to fetch the public key from attestationObject.
sdk
  • 11
  • 1
  • 3
0
votes
0 answers

webauthn yubico example not working on Firefox

I'm trying to run the this project: https://github.com/YubicoLabs/java-webauthn-passwordless-workshop On Chrome and Edge it works fine, but with Firefox I can't register my Yubikey (no Error Log, Key does not light up and waits for a touch) or…
Marley
  • 1
0
votes
1 answer

Web Authentication API strange behaviour

I want to build application where users can login using mobile fingerprint sensor, pin or face id. I found that Web Authentication API provides me with feature like this, But it behaves strangely when I try to use already created demo from internet…
O. Shekriladze
  • 1,346
  • 1
  • 19
  • 36
0
votes
1 answer

React Native Login Using WebAuth redirection to browser from app

when login using Auth0 Webauth in React-Native it opens the browser for login. I want to create a smooth login so that the user should not able to experienced whether I logged in using App or Browser jut like a webview anyone any idea?
syed irfan
  • 505
  • 4
  • 8
0
votes
1 answer

Value in passing the user object in publicKeyCredentialCreationOptions (for webauthn)

After registration via webauthn, we receive a credential id which we use to associate with that user (along with other info, like public key etc on the backend). And during login we create the publicKeyCredentialRequestOptions which we pass to…
noi.m
  • 3,070
  • 5
  • 34
  • 57
0
votes
1 answer

Few open questions around FIDO2 webauthn and U2F

I've read in multiple places that since U2F doesn’t have a concept of a user it can be used as one of the factors for login (in MFA) but not ideal for passwordless whereas webauthn has the concept of users which could help with passwordless. My…
noi.m
  • 3,070
  • 5
  • 34
  • 57
0
votes
2 answers

Is assetlinks.json file hosting mandatory for FIDO?

I have a question regarding FIDO2. Little background: My company has decided to go with FIDO2 for user account management. So we've created a FIDO Server wrapper which mainly uses yubico webauthn library.   In Android side, we are using…
albeee
  • 1,452
  • 1
  • 12
  • 20
0
votes
1 answer

identify finger id via WebAuthn API

while Google introduced WebAuthn https://developers.google.com/web/updates/2018/05/webauthn 2 years ago. Is there possible to identify exactly which finger user registered or verifying ?. For example, server will get not only public key but also get…
Thang Le
  • 1,419
  • 1
  • 17
  • 25
0
votes
1 answer

webauthn authentication javascript formatting assistance

I have been trying to figure out how to do 2fa with webauthn and I have the registration part working. The details are really poorly documented, especially all of the encoding payloads in javascript. I am able to register a device to a user, but I…
user1130176
  • 1,772
  • 1
  • 23
  • 33