CRATEFIELD
Get started with Harness Join the waitlist

auth-passkeys

WebAuthn registration and login, verified in pure Rust. No password to phish, and no account left without a way in.

As a git dependency

cargo add cratefield-auth-passkeys --git https://github.com/Cratefield/harness

In the repository, not on crates.io yet.

Source

What it is

auth-passkeys.

A passkey is registered against a signed-in session and used to log in without one. The registration options carry the relying party, the user handle, the algorithms accepted and the credentials to exclude; login options carry a challenge, and with an email the account's credential ids, otherwise an empty list so a discoverable credential can answer.

The rule worth naming is on the delete route: a passkey cannot be removed when it is the account's only way in. An account with no credential left is not a tidier account, it is a locked-out person with a support ticket.

Ports

Database · Clock · IdGen · Signer

Routes

/v1/auth-passkeys

  • /register
  • POST/v1/auth-passkeys/register/options

    session requiredA challenge, the RP, the user handle, the algorithms and the credentials to exclude

  • POST/v1/auth-passkeys/register/verify

    session requiredChecks the ceremony and stores the credential

  • /login
  • POST/v1/auth-passkeys/login/options

    publicA challenge; with an email, the account's credential ids

  • POST/v1/auth-passkeys/login/verify

    publicChecks the assertion, advances the counter, issues a session

  • /credentials
  • GET/v1/auth-passkeys/credentials

    session requiredThe account's passkeys

  • DELETE/v1/auth-passkeys/credentials/{id}

    session requiredRemoves one, unless it is the only way in

History

Changelog.

Not released on its own: it is taken from the repository as a git dependency, and has no CHANGELOG.md yet.

Google and Apple both arrive over OpenID Connect in auth-oidc. Facebook, email and password and magic links are crates of their own.

Join the waitlist All modules