Webauthn Framework
Search…
v4.0
Webauthn In A Nutshell
Symfony Bundle
Migration
Webauthn Server
To laucnh a Webauthn server, you will need the following components:
That’s a lot off classes! But don’t worry, as their configuration is the same for all your application, you just have to set them once. Let’s see all of these in the next sections.
Public Key Credential Source Repository
The Public Key Credential Source Repository must implement
Webauthn\PublicKeyCredentialSourceRepository. It will retrieve the credential source and update them when needed.You can implement the required methods the way you want: Doctrine ORM, file storage…
1
$publicKeyCredentialSourceRepository = ...; //Instantiate your repository
Copied!
Token Binding Handler
The token binding handler is a service that will verify if the token binding set in the device response corresponds to the one set in the request.
At the time of writing, we recommend to ignore this feature. Please refer to the dedicated page for more information.
1
use Webauthn\TokenBinding\IgnoreTokenBindingHandler;
2
3
$tokenBindingHandler = IgnoreTokenBindingHandler::create();
Copied!
Attestation Statement Support Manager
Every Creation Responses contain an Attestation Statement. This attestation contains data regarding the authenticator depending on several factors such as its manufacturer and model, what you asked in the options, the capabilities of the browser or what the user allowed.
The user may refuse to send information about the security token for privacy reasons.Hereafter the types of attestations you may have:
Supported Attestation Statement Types
The following attestation types are supported. Note that you should only use the
none one unless you have specific needs described in the dedicated page.none: no attestation is provided.fido-u2f: for non-FIDO2 compatible devices (old U2F security tokens).packed: generally used by authenticators with limited resources (e.g., secure elements). It uses a very compact but still extensible encoding method.android key: commonly used by old or disconnected Android devices.android safety net: for new Android devices like smartphones.trusted platform module: for devices with built-in security chips.apple: for Apple devices
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\AttestationStatement\AttestationStatementSupportManager;
6
use Webauthn\AttestationStatement\NoneAttestationStatementSupport;
7
8
// The manager will receive data to load and select the appropriate
9
$attestationStatementSupportManager = AttestationStatementSupportManager::create()
10
->add(NoneAttestationStatementSupport::create())
11
;
Copied!
Attestation Object Loader
This object will load the Attestation statements received from the devices. It will need the Attestation Statement Support Manager created above.
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\AttestationStatement\AttestationObjectLoader;
6
7
$attestationObjectLoader = AttestationObjectLoader::create(
8
$attestationStatementSupportManager
9
);
Copied!
Public Key Credential Loader
This object will load the Public Key using from the Attestation Object.
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\PublicKeyCredentialLoader;
6
7
$publicKeyCredentialLoader = PublicKeyCredentialLoader::create(
8
$attestationObjectLoader
9
);
Copied!
Extension Output Checker Handler
If you use extensions, you may need to check the value returned by the security devices. This behaviour is handled by an Extension Output Checker Manager.
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\AuthenticationExtensions\ExtensionOutputCheckerHandler;
6
7
$extensionOutputCheckerHandler = ExtensionOutputCheckerHandler::create();
Copied!
You can add as many extension checkers as you want. Each extension checker must implement
Webauthn\AuthenticationExtensions\ExtensionOutputChecker and throw a Webauthn\AuthenticationExtensions\ExtensionOutputError in case of an error.Algorithm Manager
The Webauthn data verification is based on cryptographic signatures and thus you need to provide cryptographic algorithms to perform those checks.
We recommend the use of the following algorithms to cover all types of Authenticators. Feel free to adapt this list depending on your needs.
1
<?php
2
3
declare(strict_types=1);
4
5
use Cose\Algorithm\Manager;
6
use Cose\Algorithm\Signature\ECDSA\ES256;
7
use Cose\Algorithm\Signature\ECDSA\ES256K;
8
use Cose\Algorithm\Signature\ECDSA\ES384;
9
use Cose\Algorithm\Signature\ECDSA\ES512;
10
use Cose\Algorithm\Signature\EdDSA\Ed256;
11
use Cose\Algorithm\Signature\EdDSA\Ed512;
12
use Cose\Algorithm\Signature\RSA\PS256;
13
use Cose\Algorithm\Signature\RSA\PS384;
14
use Cose\Algorithm\Signature\RSA\PS512;
15
use Cose\Algorithm\Signature\RSA\RS256;
16
use Cose\Algorithm\Signature\RSA\RS384;
17
use Cose\Algorithm\Signature\RSA\RS512;
18
19
$algorithmManager = Manager::create()
20
->add(
21
ES256::create(),
22
ES256K::create(),
23
ES384::create(),
24
ES512::create(),
25
26
RS256::create(),
27
RS384::create(),
28
RS512::create(),
29
30
PS256::create(),
31
PS384::create(),
32
PS512::create(),
33
34
Ed256::create(),
35
Ed512::create(),
36
)
37
;
Copied!
Authenticator Attestation Response Validator
This object is what you will directly use when receiving Attestation Responses (authenticator registration).
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\AuthenticatorAttestationResponseValidator;
6
7
$authenticatorAttestationResponseValidator = AuthenticatorAttestationResponseValidator::create(
8
$attestationStatementSupportManager,
9
$publicKeyCredentialSourceRepository,
10
$tokenBindingHandler,
11
$extensionOutputCheckerHandler
12
);
Copied!
Authenticator Assertion Response Validator
This object is what you will directly use when receiving Assertion Responses (user authentication).
1
<?php
2
3
declare(strict_types=1);
4
5
use Webauthn\AuthenticatorAssertionResponseValidator;
6
7
$authenticatorAssertionResponseValidator = AuthenticatorAssertionResponseValidator::create(
8
$publicKeyCredentialSourceRepository, // The Credential Repository service
9
$tokenBindingHandler, // The token binding handler
10
$extensionOutputCheckerHandler, // The extension output checker handler
11
$algorithmManager // The COSE Algorithm Manager
12
);
Copied!
Last modified 12d ago
Export as PDF
Copy link
Edit on GitHub
Contents
Public Key Credential Source Repository
Token Binding Handler
Attestation Statement Support Manager
Supported Attestation Statement Types
Attestation Object Loader
Public Key Credential Loader
Extension Output Checker Handler
Algorithm Manager
Authenticator Attestation Response Validator
Authenticator Assertion Response Validator