Skip to content

Latest commit

History

History
179 lines (155 loc) 路 22.8 KB

README.md

File metadata and controls

179 lines (155 loc) 路 22.8 KB

馃攼 WebAuthn Awesome Awesome

Curated list of tools and projects related to WebAuthn and Passkeys

WebAuthn is a W3C standard that allows users to authenticate to websites using their preferred device. WebAuthn is supported by most browsers and platforms, and can be used with FIDO2, CTAP, U2F, and other devices.

Passkey is an umbrella term that basically means FIDO.

Contributions welcome. Add links through pull requests or create an issue to start a discussion. Please read the contribution guidelines before contributing.

Contents

Demos

Server Libraries

Client Libraries

Software Authenticators

Hardware Authenticators

  • FIDO CERTIFIED鈩 SoloKeys - Solo is an open source FIDO2 security key, and you can get one at https://solokeys.com.
  • FIDO CONFORMANT Conor Patrick: U2F Zero - U2F Zero is an open source U2F token for 2 factor authentication.
  • Trezor - Trezor is an open source hardware wallet with FIDO/U2F and FIDO2/WebAuthn functionality.
  • Google: OpenSK - OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
  • Nitrokey - Nitrokey is developing/producing different types of open source and open hardware FIDO2 security keys (check for the "Nitrokey FIDO2" and "Nitrokey 3" related repositories).
  • BryanJacobs: FIDO2Applet - FIDO2 CTAP2 Javacard Applet.
  • darconeous: u2f-javacard - A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard (More recent fork of Ledger).

Dev tools

  • Shane B Weeden: FIDO2 Postman Clients - FIDO2 Postman clients to easily test your FIDO2 API endpoints.
  • MasterKale: WebAuthn Previewer - A simple website for previewing WebAuthn attestations and assertions.
  • Firstyear: Webauthn RS compatability tester - A webauthn device and browser stress tester that can identify flaws in implementations and has already found bugs in Firefox, Safari, Android and more.
  • Descope: VirtualWebAuthn Test Tool - A GO package to automate testing of a relying party WebAuthn server implementation without requiring a browser or an actual authenticator.
  • FIDO MDS Explorer - A user-friendly web UI to explore the FIDO Metadata Service repository, which contains detailed characteristics and attestation certificates of authenticators registered to the FIDO Alliance.
  • WebAuthn Playground - A web page (no server) to test WebAuthn operations with configurable parameters, and view/parse responses.

Tutorials

Articles

Slides

Books

  • Getting started with WebAuthn - 銈炽儫銉冦偗銉炪兗銈便儍銉95銇ч爳甯冦仐銇熷悓浜鸿獙銆孏etting started with WebAuthn銆嶃伄闆诲瓙鐗(PDF)銇с仚.
  • Password authentication for web and mobile apps - A book by Dmitry Chestnykh @dchest about authentication on web and mobile. Talks in depth about correct password authenticatoin, and additionally introduces to FIDO2/Webauthn.

Other

FAQ

What is FIDO CERTIFIED鈩?

FIDO CERTIFIED means that implementation has passed FIDO conformance tools, passed interoperability even, and has achieved official FIDO Alliance certification. A registered FIDO Alliance Trademark.

What is FIDO CONFORMANT?

FIDO CONFORMANT means that implementation has passed FIDO conformance tools (as reported by the author), thus can claim that it is conformant with FIDO2 specifications. If you want to get access to the conformance tools, you can do it here https://fidoalliance.org/certification/functional-certification/conformance/. If you have passed conformance tools, send me a DM or a tweet @herrjemand with a screenshot of passing the tests.

FIDO2 or WebAuthn?

FIDO2 is the name of the standard. WebAuthn is just browser JS API to talk to the authenticators. So correct way to call your server is "FIDO2 Server" and to say "Authentication with FIDO2".

I would like to advertise my company product here!

Please don't. The advertisement you can get is by writing a good, deep, technical article, or open sourcing your server or/and tools is much better for you, than cheap show off. People will buy your company product if you show them that you know what you are doing.

Otherwise we have strict no ads policy. We will only link to open source repos and actual articles. No company websites.