@firebase-web-authn/functions

@firebase-web-authn/functions

An unofficial Firebase extension for authentication with WebAuthn passkeys.

This package contains a Firebase Function that registers and authenticates WebAuthn passkeys, manages public key credentials in Firestore, and cleans up data if the user cancels a process or unlinks a passkey.

Demo: https://firebase-web-authn.dev

Deployment

From your Firebase Functions package root, run:

% npm install @firebase-web-authn/functions --save

Export the function from your functions/index.ts file by calling getFirebaseWebAuthn with a config object.

import { initializeApp }       from 'firebase-admin/app';
import { HttpsFunction }       from "firebase-functions";
import { getFirebaseWebAuthn } from '@firebase-web-authn/functions';


initializeApp();

export const firebaseWebAuthn: HttpsFunction = getFirebaseWebAuthn({
  authenticatorAttachment: "platform",
  relyingPartyName: "FirebaseWebAuthn Demo",
  userVerificationRequirement: "required",
});

// Other functions...

interface FirebaseWebAuthnConfig {
  authenticatorAttachment?: AuthenticatorAttachment,         // Whether to allow platform passkeys (stored in browser and/or cloud).
  relyingPartyName: string,                                  // Your app's display name in the passkey popup on some platforms.
  userVerificationRequirement?: UserVerificationRequirement, // Whether to require user verification.
}

Deploy your Firebase Functions:

% firebase deploy --only functions

Public keys are stored in the webAuthnUsers collection in Firestore. Setup doesn't require you to modify any Firestore rules. Your app should use a separate users/profiles collection to store user information.

Usage

For the browser to reach FirebaseWebAuthn, modify your firebase.json to include a rewrite on each app where you'd like to use passkeys.

{
  "hosting": [
    {
      "target": "...",
      "rewrites": [
        {
          "source": "/firebaseWebAuthn",
          "function": "firebaseWebAuthn"
        }
      ]
    }
  ]
}

Google Cloud setup

• Enable the Anonymous authentication provider in Firebase.
• Grant the Service Account Token Creator role to the App Engine default service account principal in Service accounts under App Engine default service account > Permissions.
• Grant the Cloud Functions Invoker role to the allUsers principal in Cloud Functions under firebaseWebAuthn > Permissions.