@simplewebauthn/server

What is @simplewebauthn/server?

@simplewebauthn/server is a Node.js library that provides server-side functionality for WebAuthn, a web standard for secure authentication using public key cryptography. It helps in implementing registration and authentication flows for WebAuthn, making it easier to integrate strong, passwordless authentication into web applications.

What are @simplewebauthn/server's main functionalities?

Registration

This feature allows you to generate registration options for a new user and verify the registration response from the client. It ensures that the registration process is secure and follows the WebAuthn protocol.

const { generateRegistrationOptions, verifyRegistrationResponse } = require('@simplewebauthn/server');

// Generate registration options
const options = generateRegistrationOptions({
  rpName: 'Example Corp',
  rpID: 'example.com',
  userID: 'user-id',
  userName: '[e-mail]',
  attestationType: 'indirect',
  authenticatorSelection: {
    userVerification: 'preferred',
  },
});

// Verify registration response
const verification = verifyRegistrationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
});

Authentication

This feature allows you to generate authentication options for an existing user and verify the authentication response from the client. It ensures that the authentication process is secure and follows the WebAuthn protocol.

const { generateAuthenticationOptions, verifyAuthenticationResponse } = require('@simplewebauthn/server');

// Generate authentication options
const options = generateAuthenticationOptions({
  rpID: 'example.com',
  userVerification: 'preferred',
});

// Verify authentication response
const verification = verifyAuthenticationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
  authenticator: authenticator,
});

Other packages similar to @simplewebauthn/server

fido2-lib

fido2-lib is a library for implementing FIDO2 and WebAuthn server functionality. It provides similar features to @simplewebauthn/server, such as registration and authentication flows, but may require more manual setup and configuration.

webauthn

webauthn is another library for implementing WebAuthn server functionality. It offers a straightforward API for handling registration and authentication, similar to @simplewebauthn/server, but with a different approach to configuration and usage.

README

@simplewebauthn/server

• Installation
• Usage
• Supported Attestation Formats

Installation

This package is available on npm:

npm install @simplewebauthn/server

Usage

You can find in-depth documentation on this package here: https://simplewebauthn.dev/docs/packages/server

Supported Attestation Formats

SimpleWebAuthn supports all current WebAuthn attestation formats, including:

• Packed
• TPM
• Android Key
• Android SafetyNet
• FIDO U2F
• None
• Apple

Changelog

v6.0.0 - The one with Ed25519 Support

This release also marks the return of the library's ability to pass FIDO Conformance! Adding Ed25519 signature verification (see below) finally allowed the library to pass all required tests, and nearly all optional tests.

Packages:

• @simplewebauthn/browser@6.0.0
• @simplewebauthn/server@6.0.0
• @simplewebauthn/testing@6.0.0
• @simplewebauthn/typescript-types@6.0.0

Changes:

• [server] Signatures can now be verified with OKP public keys that use the Ed25519 curve and EDDSA algorithm (#256)
• [testing] Version sync
• [typescript-types] Version sync

Breaking Changes

• [server] verifyAuthenticationResponse() now returns Promise<VerifiedAuthenticationResponse> instead of VerifiedAuthenticationResponse (#256)

Update your existing calls to verifyAuthenticationResponse() to handle the values resolved by the promises, whether with .then() or await depending on your code structure:

Before:

const verification = verifyAuthenticationResponse({
  // ...
});

After:

const verification = await verifyAuthenticationResponse({
  // ...
});

• [browser] browserSupportsWebauthn() has been renamed to browserSupportsWebAuthn() (#257)

Update calls to browserSupportsWebauthn() to capitalize the "A" in "WebAuthn":

Before:

if (browserSupportsWebauthn()) {
  // ...
}

After:

if (browserSupportsWebAuthn()) {
  // ...
}