Advanced behaviours¶
This section covers advanced WebAuthn features and customization options for Pure PHP implementations.
Overview¶
While the basic WebAuthn implementation covers most use cases, you may need to customize certain behaviors to meet specific security or user experience requirements. These advanced topics help you fine-tune your WebAuthn integration.
Available topics¶
Security & validation¶
- Debugging - Enable debug logging to troubleshoot WebAuthn operations
- Authenticator Counter - Detect cloned authenticators using signature counters
- Attestation and Metadata Statement - Verify authenticator attestations and trust anchors
User experience¶
- User Verification - Configure biometric or PIN requirements
- Authenticator Selection Criteria - Control which authenticators can be used
- Authentication without Username - Enable resident keys for passwordless login
Credential management¶
- Signal API - Inform clients about credential status changes (new in 5.3.0)
- Backup Events - React to backup eligibility and status changes (new in 5.3.0)
- Conditional Create - Auto-register credentials after password login (new in 5.3.0)
Technical configuration¶
- Authenticator Algorithms - Configure supported cryptographic algorithms
- Extensions - Use WebAuthn extensions for additional features
- Cross Origin Authentication - Handle localhost and development environments
When to use advanced features¶
Most applications will work fine with the default WebAuthn configuration. Consider these advanced features when:
- Security is paramount: Use attestation verification and counter checking for high-security applications
- User experience matters: Enable usernameless authentication and optimize authenticator selection
- Debugging issues: Enable logging when troubleshooting registration or authentication problems
- Compliance requirements: Some regulations may require specific attestation or verification settings
Quick start¶
For basic WebAuthn implementation, start with these pages:
- WebAuthn Server - Set up the basic server components
- Authenticator Registration - Register user authenticators
- Authenticate Your Users - Perform authentication
Then return to this section for advanced customization.
Info
If you're using the Symfony Bundle, see the Symfony Bundle Advanced Behaviors section for framework-specific implementations.