Stack Overflow
Stack Overflow

Questions tagged [webauthn]

Browser API implementing the Web Authentication standard. Credentials are stored on (local) authenticators which use and are accessed using strong cryptography.

See Web Authentication: A Web API for accessing scoped credentials:

This specification defines an API that enables web pages to access WebAuthn compliant strong cryptographic credentials through browser script. Conceptually, one or more credentials are stored on an authenticator, and each credential is scoped to a single Relying Party. Authenticators are responsible for ensuring that no operation is performed without the user’s consent. The user agent mediates access to credentials in order to preserve user privacy. Authenticators use attestation to provide cryptographic proof of their properties to the relying party. This specification also describes a functional model of a WebAuthn compliant authenticator, including its signature and attestation functionality.

303 questions
3
votes
1 answer

WebAuthn authentication and registration using TouchID on two different browsers?

The case where a person registers a new account (via credentials.create) and subsequently logs in using the same browser (via credentials.get) is straightforward, because at the time credentials.create is called, the user must grant their browser…
mkhbragg
  • 131
  • 3
  • 12
3
votes
2 answers

How to retrieve a symmetric key using Webauthn/CTAP HMAC-Secret extension in a web browser?

I am trying to leverage the CTAP hmac-secret extension to retrieve a key for symmetric encryption in a web browser. I have Yubikey5 which implements this extension. I read through the CTAP specs, but I cannot find a reference how to do it once I get…
ucipass
  • 923
  • 1
  • 8
  • 21
3
votes
4 answers

Android FIDO2 throwing vague errors

I am trying to implement FIDO2 on Android. I have the assetlinks.json hosted on my domain (Sorry I don't want and not sure if I'm allowed to reveal the whole url yet). I have the assets_statements string defined and added it to my Manifest and I…
Tooroop
  • 1,824
  • 1
  • 20
  • 31
3
votes
2 answers

WebAuthn authenticator attestation response id and rawId

I would like to ask a question regarding id and rawId. When implementing webauthn, in the authenticator attestation response, I see that we have both id and rawId . Reading the spec (https://www.w3.org/TR/webauthn-1/#dom-publickeycredential-rawid) ,…
truongnm
  • 2,311
  • 2
  • 31
  • 48
3
votes
0 answers

Does Keycloak expose WebAuthn APIs or can Webauthn flow be managed programmatically

We are currently evaluating Keycloak Passwordless login feature which is called Webauthn and follows FIDO2 specification. I am able to customize authentication flow (through admin console of keycloak) and login with fido2 device (platform…
Samir
  • 655
  • 5
  • 14
3
votes
1 answer

How to disallow the FIDO Webauthn key registration from virtual authenticator browser extension

The virtual authenticator extension provided in Chrome (virtual authenticators tab) is used for testing / debugging the FIDO2 Webauthn authentication mechanism without using physical authenticator keys. This is useful in automated testing e.g. via…
PJW
  • 344
  • 2
  • 9
3
votes
2 answers

Selenium Tests: Authenticate with Webauthn

In my use case, there is a registration page that triggers the browser-specific webauthn flow. For example in Chrome on a Mac you will see this series of popups: Pick an option between USB security key and Built-in sensor MacOS confirmation with…
mkhbragg
  • 131
  • 3
  • 12
3
votes
1 answer

FIDO2 compatibility with U2F/CTAP1

There are many sources that say FIDO2/CTAP2 is backward compatible with U2F: ...all previously certified FIDO U2F Security Keys and YubiKeys will continue to work as a second-factor authentication login experience with web browsers and online…
Robert Quattlebaum
  • 388
  • 2
  • 10
3
votes
1 answer

Usernames exposed by login attempt?

I'm trying to expand my application to support WebAuthn login. So far, I have successfully set up a test application (using this https://github.com/lbuchs/WebAuthn PHP implementation) on my local server. I think I mostly understood the process now,…
LeRainieur
  • 59
  • 4
3
votes
0 answers

Chrome and Firefox return different error when click cancel button on browsers popup during FIDO2 credentai get

When I click cancel on dialog Chrome returns NotAllowedError, But Firefox returns AbortError In W3C Webauthn document, It says following thing 18. While lifetimeTimer has not expired, perform the following actions depending upon lifetimeTimer,…
Daichi
  • 198
  • 2
  • 13
3
votes
2 answers

Calculate hash for signature verification in webauthn

I'm trying to implement webauthn, but am having trouble getting the signature verification to work. According to https://w3c.github.io/webauthn/#verifying-assertion I have to basically verify the signature over the following data: authData ||…
Martijn Otto
  • 878
  • 4
  • 21
3
votes
2 answers

How to check browser is public-key credentials supported?

I am implementing webauthn using PHP, now I'm facing problem with how to detect browser is public-key credentials supported or not. If browser is supported public-key credentials then I have to start fingerprint registration procedure. So is there…
Sachin
  • 789
  • 5
  • 18
2
votes
1 answer

Fido2ApiCall failed in Chromium for Android, mode = BROWSER

Checking out and building Chromium for Android (https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/android_build_instructions.md) install and run Chromium for Android navigate https://webauthn.io enter any username press Register…
Sergey Shpital
  • 31
  • 1
2
votes
1 answer

How to know if a WebAuthn exception should be displayed?

I'm currently in the process of evaluating the implementation of WebAuthn/Passkeys on a website, and one thing that I'm having trouble finding information on is what exceptions from the WebAuthn API the user should be notified about. There are many…
Dolda2000
  • 25,216
  • 4
  • 51
  • 92
2
votes
1 answer

Webauthn securely store user credential data

I am trying to add webauthn to my web app, and I want to securely store a private key with the credential data. The methods I have found for storing data with a credential are: hmac-secret extension, large blob extension,…
Randusr
  • 39
  • 6
1 2 3
…
20 21