WebAuthn is a web authentication standard for passwordless login. It uses public-key cryptography with device biometrics, built-in authenticators, or phishing-resistant physical security keys. section 15.0 section 2.1.5
Instead of sending a reusable password, the device proves possession of a private key while the application stores and verifies the corresponding public key. Biometrics remain on the device, and hardware keys bind authentication to the original website. section 15.1 section 15.4
A basic WebAuthn flow separates registration from authentication:
- Check browser support, create a credential and key pair, then associate the credential ID and public key with the user. section 15.3 section 15.4
- Generate a fresh server challenge, request an assertion with navigator.credentials.get(), and verify the signature, challenge, and origin. section 15.3 section 15.3.1
- Serve the page from localhost or HTTPS because WebAuthn requires a secure context; provide backup authenticators because losing a key can cause lockout. section 15.4
A small registration and login demo
A plain JavaScript page checks window.PublicKeyCredential, calls navigator.credentials.create() with a challenge and user details, and sends the resulting public-key credential to a backend. During login, the backend returns a random challenge and registered credential ID; the browser signs the challenge, and the backend verifies the signature before authenticating the user. The simplified demonstration omits the polished error handling and feedback expected in production.
Figure 2.6 Externalize application authentication into an SSO service that applications can access using OIDC and WebAuthn. If you know OIDC and WebAuthn, you can use all modern SSO services.
Use the architecture figure to see WebAuthn positioned at the application boundary through an external SSO service, alongside OIDC. section 2.1.5
