@firebase-web-authn/functions

@firebase-web-authn/functions

A Firebase extension for authentication with WebAuthn passkeys.

This package contains a Firebase Function that registers and authenticates WebAuthn passkeys, manages public key credentials in Firestore, and cleans up data if the user cancels a process or unlinks a passkey.

Demo: https://firebase-web-authn.dev

Deployment

From your Firebase Functions package root, run:

% npm install @firebase-web-authn/functions --save

Export the function by calling getFirebaseWebAuthn with a config object.

import { initializeApp }       from "firebase-admin/app";
import { HttpsFunction }       from "firebase-functions";
import { getFirebaseWebAuthn } from "@firebase-web-authn/functions";


getApps().length === 0 && initializeApp();

export const firebaseWebAuthn: HttpsFunction = getFirebaseWebAuthn({...});

// Other functions...

interface FirebaseWebAuthnConfig {
  authenticatorAttachment: AuthenticatorAttachment,          // Preferred authenticator attachment modality. "cross-platform" allows security keys. "platform" allows passkey managers.
  relyingPartyName: string,                                  // Your app's display name in the passkey popup on some browsers.
  userVerificationRequirement?: UserVerificationRequirement, // Your app's user verification requirement. "preferred" is default.
}

Deploy your Firebase Functions:

% firebase deploy --only functions

Public keys are stored in the webAuthnUsers collection in Firestore. Setup doesn't require you to modify any Firestore rules. Your app should use a separate users/profiles collection to store user information.

Usage

For the browser to reach FirebaseWebAuthn, modify your firebase.json to include a rewrite on each app where you'd like to use passkeys.

{
  "hosting": [
    {
      "target": "...",
      "rewrites": [
        {
          "source": "/firebaseWebAuthn",
          "function": "firebaseWebAuthn"
        }
      ]
    }
  ]
}

Google Cloud setup

• Set up these services in your Firebase project:
  • Firebase Authentication and the Anonymous provider.
  • Cloud Firestore
  • Cloud Functions
• Grant the Cloud Datastore User and Service Account Token Creator roles to the App Engine default service account principal in Service accounts under App Engine default service account > Permissions.
• Grant the Cloud Functions Invoker role to the allUsers principal in Cloud Functions under firebaseWebAuthn > Permissions.