cbsecurity-passkeys

Implement WebAuthn passkeys in ColdBox by generating registration options on the server, storing the challenge in session, returning options to the client, then verifying the credential response and persisting it in your repository.

A credential repository for WebAuthn authentication is an interface for storing passkey metadata. It requires an implementation that persists credential data alongside a database migration for secure retrieval during registration and authentication ceremonies.

Challenge lifecycle management during passkey registration involves generating server-side challenges, storing them in the user session, and validating the client's credential response against the original challenge to prevent replay attacks.

HTTPS and origin validation are required for production WebAuthn passkey deployment. Production hardening demands strict rpId and origin checks, alongside signCount validation, to ensure secure passwordless authentication.

You can migrate an existing ColdBox login flow to passwordless authentication by replacing traditional credentials with WebAuthn passkeys, enabling users to register and authenticate while maintaining anti-replay and origin validation.

SignCount validation matters in WebAuthn authentication ceremonies because it provides anti-replay protection by tracking authenticator usage counters, helping detect cloned or compromised credentials during the verification process.