WebAuthnLogin Plugin
WebAuthn allows supported browsers/devices to use a passkey or hardware authenticator. It can reduce password phishing, but administrators need a tested enrollment and recovery process before requiring it.
- Use the final public HTTPS domain; WebAuthn credentials are bound to site identity/domain.
- Keep server clocks correct and avoid changing domains after enrollment.
- Enable the plugin and enroll a disposable normal account first.
- Test more than one browser/device and register a backup authenticator where supported.
- Keep a protected administrator recovery method.
The current plugin has little/no ordinary parameter configuration; most behavior occurs during registration/authentication. That does not remove the need for account-recovery policy.
Will passkeys work on HTTP or an IP address? Production use requires a secure, correctly identified origin; use the final HTTPS hostname.
What if a user loses the device? Use a verified recovery flow or another previously registered authenticator. Never disable account security based only on an e-mail request.
Does it replace UserOTPLogin? They are different authentication factors/technologies. Decide and test how they interact before enabling both broadly.
| Plugin | Added value |
|---|---|
| LoginControl | Adds extra sign-in and recovery controls. |
| UserOTPLogin | Adds a one-time-password login option. |
| Social login collection | Compares Apple, Google, Facebook, LDAP, WordPress, and other providers. |
