@simplewebauthn/server

What is @simplewebauthn/server?

@simplewebauthn/server is a Node.js library that provides server-side functionality for WebAuthn, a web standard for secure authentication using public key cryptography. It helps in implementing registration and authentication flows for WebAuthn, making it easier to integrate strong, passwordless authentication into web applications.

What are @simplewebauthn/server's main functionalities?

Registration

This feature allows you to generate registration options for a new user and verify the registration response from the client. It ensures that the registration process is secure and follows the WebAuthn protocol.

const { generateRegistrationOptions, verifyRegistrationResponse } = require('@simplewebauthn/server');

// Generate registration options
const options = generateRegistrationOptions({
  rpName: 'Example Corp',
  rpID: 'example.com',
  userID: 'user-id',
  userName: '[e-mail]',
  attestationType: 'indirect',
  authenticatorSelection: {
    userVerification: 'preferred',
  },
});

// Verify registration response
const verification = verifyRegistrationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
});

Authentication

This feature allows you to generate authentication options for an existing user and verify the authentication response from the client. It ensures that the authentication process is secure and follows the WebAuthn protocol.

const { generateAuthenticationOptions, verifyAuthenticationResponse } = require('@simplewebauthn/server');

// Generate authentication options
const options = generateAuthenticationOptions({
  rpID: 'example.com',
  userVerification: 'preferred',
});

// Verify authentication response
const verification = verifyAuthenticationResponse({
  credential: response,
  expectedChallenge: options.challenge,
  expectedOrigin: 'https://example.com',
  expectedRPID: 'example.com',
  authenticator: authenticator,
});

Other packages similar to @simplewebauthn/server

fido2-lib

fido2-lib is a library for implementing FIDO2 and WebAuthn server functionality. It provides similar features to @simplewebauthn/server, such as registration and authentication flows, but may require more manual setup and configuration.

webauthn

webauthn is another library for implementing WebAuthn server functionality. It offers a straightforward API for handling registration and authentication, similar to @simplewebauthn/server, but with a different approach to configuration and usage.

README

@simplewebauthn/server

• Installation
  • Node LTS 16.x or higher
  • Deno v1.33.x or higher
• Usage
• Supported Attestation Formats

Installation

Node LTS 16.x or higher

This package is available on npm and supports both CommonJS and ECMAScript modules (ESM) projects:

npm install @simplewebauthn/server

Deno v1.33.x or higher

It is also available for import into Deno projects from deno.land/x:

import {...} from 'https://deno.land/x/simplewebauthn/deno/server.ts';

Usage

You can find in-depth documentation on this package here: https://simplewebauthn.dev/docs/packages/server

Supported Attestation Formats

SimpleWebAuthn supports all current WebAuthn attestation formats, including:

• Android Key
• Android SafetyNet
• Apple
• FIDO U2F
• Packed
• TPM
• None

Changelog

v8.0.0 - Around the (ESM) World

This major release marks the completion of a long journey that started with the release of v7.0.0: SimpleWebAuthn is now available for use in non-Node projects! 🎉

SimpleWebAuthn debuted in mid-2020 as a combination of libraries aiming to make WebAuthn simpler to use across browsers and "NodeJS + CommonJS" applications. Since then NodeJS has evolved to gain ESM support, and additional JavaScript and TypeScript runtimes have debuted that offer ESM-centric, TypeScript-first alternatives while also implementing Web APIs to offer a more consistent and capable execution environment for developers.

I've wanted to make this project available to developers using these Node alternatives to help them get past some of WebAuthn's rough spots. Today I'm happy to announce that this goal has been achieved! 😌

See the Changes below for more information, as well as additional information on breaking changes made in this release.

Packages

• @simplewebauthn/browser@8.0.0
• @simplewebauthn/server@8.0.0
• @simplewebauthn/typescript-types@8.0.0

Changes

• [server] [typescript-types] SimpleWebAuthn can now also be used in runtimes other than Node. Deno is now a first-class runtime for this project alongside Node (#425)
  • The following list of runtimes are officially supported:
    • (Existing) NodeJS using CommonJS
    • (Existing) NodeJS using ECMAScript Modules (ESM)
    • (New) Deno @ https://deno.land/x/simplewebauthn
  • The following list of runtimes are periodically tested but unofficially supported:
    • (New) CloudFlare Workers
    • (New) Bun
• [browser] Version sync

Breaking Changes

• [server] generateRegistrationOptions() and generateAuthenticationOptions() are now asynchronous methods. Refactor calls to these methods to handle the Promise that's now returned in whatever way is appropriate for your project.
• [server] generateChallenge() (in @simplewebauthn/server/helpers) is now an asynchronous method. Refactor calls to this method to handle the Promise that's now returned in whatever way is appropriate for your project.