WebAuthn.Net

Working implementation of the WebAuthn Level 3 standard for .NET 6 and .NET 8

Purpose

Our goal is to create an easy-to-use, expandable, production-ready implementation of the WebAuthn Relying Party library for the latest version of the WebAuthn standard, which passes the FIDO conformance test, and is adapted for LTS versions of .NET (6 and 8 at the moment).

Supported features

• ✅ Passkeys are supported out of the box
• ✅ Attestation API & verification (Register and verify credentials/authenticators)
• ✅ Assertion API & verification (Authenticate users)
• ✅ 100% completion of the entire FIDO Conformance Test, including all optional features
• ✅ Authenticators embedded in the device (FaceID, TouchID, Windows Hello)
• ✅ Roaming aka cross-platform authenticators (USB/NFC/BLE keys, for example Yubico)
• ✅ All current attestation statement formats
  • packed
  • tpm
  • android-key
  • android-safetynet
  • fido-u2f
  • none
  • apple
• ✅ All cryptographic algorithms required to pass the FIDO Conformance Test
  • RS1
  • RS256
  • RS384
  • RS512
  • PS256
  • PS384
  • PS512
  • ES256
  • ES384
  • ES512
  • EdDSA (via libsodium, because .NET currently doesn't support Ed25519)
• ✅ Processing of each request with a single transaction
• ✅ Ready-to-use storage implementations
  • Microsoft SQL Server
  • PostgreSQL
  • MySQL
  • InMemory (for sample applications)
• ✅ Sample applications
• ✅ Exceptionless API (avoid exceptions wherever possible)
• ✅ Designed with extensibility in mind (almost any library component can be overridden)
• ✅ Intellisense documentation

Local development

Required dependencies

• .NET SDK 6.0.417+
• .NET SDK 8.0.100+

Releasing

• Create release via Github New Release
• Specify tag by semver (example: 1.3.37) and target branch (main by default) then publish
• Github Actions will trigger on new release and publish NuGet package for a release

Tips for Contribution

Any contributions appreciated! If you have an idea, feature request, or you find a bug – feel free to open new issue.

There are few tips how to make your contribution even better

• Start with issue. Even if you want to write code by yourself to implement some feature or fix a bug, please create Issue first and link it in the Pull Request. It allows us to better understand what problem you are trying to solve.
• When you create a Pull Request make sure triggered GitHub Actions workflow finished successfully.

Acknowledgements

WebAuthn.Net is built using the following wonderful tools

• .NET
• ASP.NET Core
• FIDO2 .NET Library (WebAuthn)
• JetBrains Rider