@simplewebauthn/server

What is @simplewebauthn/server?

@simplewebauthn/server is a Node.js library that provides server-side functionality for WebAuthn, a web standard for secure authentication using public key cryptography. It helps in implementing registration and authentication flows for WebAuthn, making it easier to integrate strong, passwordless authentication into web applications.

What are @simplewebauthn/server's main functionalities?

Registration

This feature allows you to generate registration options for a new user and verify the registration response from the client. It ensures that the registration process is secure and follows the WebAuthn protocol.

const { generateRegistrationOptions, verifyRegistrationResponse } = require('@simplewebauthn/server');

// Generate registration options
const options = generateRegistrationOptions({
  rpName: 'Example Corp',
  rpID: 'example.com',
  userID: 'user-id',
  userName: '[e-mail]',
  attestationType: 'indirect',
  authenticatorSelection: {
    userVerification: 'preferred',
  },
});

// Verify registration response
const verification = verifyRegistrationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
});

Authentication

This feature allows you to generate authentication options for an existing user and verify the authentication response from the client. It ensures that the authentication process is secure and follows the WebAuthn protocol.

const { generateAuthenticationOptions, verifyAuthenticationResponse } = require('@simplewebauthn/server');

// Generate authentication options
const options = generateAuthenticationOptions({
  rpID: 'example.com',
  userVerification: 'preferred',
});

// Verify authentication response
const verification = verifyAuthenticationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
  authenticator: authenticator,
});

Other packages similar to @simplewebauthn/server

fido2-lib

fido2-lib is a library for implementing FIDO2 and WebAuthn server functionality. It provides similar features to @simplewebauthn/server, such as registration and authentication flows, but may require more manual setup and configuration.

webauthn

webauthn is another library for implementing WebAuthn server functionality. It offers a straightforward API for handling registration and authentication, similar to @simplewebauthn/server, but with a different approach to configuration and usage.

README

@simplewebauthn/server

• Installation
• Usage
• Supported Attestation Formats

Installation

This package is available on npm:

npm install @simplewebauthn/server

Usage

You can find in-depth documentation on this package here: https://simplewebauthn.dev/docs/packages/server

Supported Attestation Formats

SimpleWebAuthn supports all current WebAuthn attestation formats, including:

• Packed
• TPM
• Android Key
• Android SafetyNet
• FIDO U2F
• None
• Apple

Changelog

v3.0.0 - The one with a legacy

This release is focused on updating @simplewebauthn/browser for better browser support out of the box. Most projects will now pull in its (slightly larger) ES5 bundle to ensure maximum browser compatibility, including older browsers in which WebAuthn will never be available. The ES2018 build is still available for projects that only need to target newer browsers, but bundler configuration changes must now be made to include it instead of the ES5 build.

Packages:

• @simplewebauthn/browser@3.0.0
• @simplewebauthn/server@3.0.0
• @simplewebauthn/typescript-types@3.0.0

Changes:

• [browser] Set default bundle to ES5 to support IE10+ and Edge Legacy
• [browser] startAssertion() no longer Base64URL-encodes userHandle string
• [server] Fix issue with Chrome (< v90) WebAuthn virtual authenticators
• [server] Update jsrsasign to 10.2.0 (see GHSA-27fj-mc8w-j9wg)
• [typescript-types] Update assertion JSON declarations as per startAssertion() fix

Breaking Changes

• [browser] Projects targeting modern browsers may not wish to bundle the ES5 version due to its inclusion of various polyfills. See the updated "Building for Production" section of the README.md for more info on how to pull in the ES2018 version instead.
• [browser] RPs with usernameless flows will no longer need to Base64URL-decode response.userHandle as returned from startAssertion().