cbsecurity-passkeys

What problem does it solve?

Adds clear, production-ready guidance and code patterns for implementing WebAuthn/Passkeys authentication in ColdBox applications, removing uncertainty around credential storage, ceremony handling, and security hardening so teams can deploy passwordless login safely.

Core Features & Use Cases

• Credential repository interface with an example implementation and a database migration for storing passkey metadata.
• Registration and authentication ceremonies including server-side challenge management, verification, signCount validation, and JWT issuance for authenticated sessions.
• JavaScript integration and deployment guidance covering client-side option generation, challenge lifecycle, HTTPS requirements, rpId/origin checks, and production hardening recommendations.
• Use Case: Migrate an existing ColdBox login flow to passwordless authentication, enabling users to register passkeys and authenticate via WebAuthn while maintaining strong anti-replay and origin validation.

Quick Start

Generate registration options on the server, store the challenge in session, return the options to the client, then verify the client's credential response and persist the credential in your repository.