skills.rest
ColdBox
ColdBoxOFFICIAL
Explore all skills by this author →
Website𝕏@coldboxGitHub

coldbox-security-passkeys

Implement WebAuthn passkey registration and authentication in ColdBox applications.

1|Updated Apr 10, 2026
Search Tags:#security#authentication#passkeys#passwordless#webauthn#fido2#coldbox
One-click install
npx skills add https://github.com/ColdBox/skills --skill coldbox-security-passkeys
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coldbox-security-passkeys
Source: https://github.com/ColdBox/skills/tree/main/security/passkeys-integration
Command: npx skills add https://github.com/ColdBox/skills --skill coldbox-security-passkeys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provide a secure, phishing-resistant alternative to passwords by enabling WebAuthn/FIDO2 passkey registration and authentication in ColdBox applications, reducing password-related attacks and user friction.

Core Features & Use Cases

  • Server-side WebAuthn flows: Generate registration and authentication challenges, verify assertions, and integrate with ColdBox event handlers.
  • Credential lifecycle management: Store public keys, update sign counts, list user devices, and revoke compromised passkeys.
  • Integration example: Add passkey registration and passwordless login to an existing ColdBox site using cbsecurity-passkeys, custom PasskeyStorageService persistence, and routes/handlers for browser interactions.

Quick Start

Add passkey-based WebAuthn registration, authentication, and device management to my ColdBox application using cbsecurity-passkeys and a custom credential storage service.

Frequently Asked Questions about coldbox-security-passkeys

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement passkey authentication in a ColdBox application?▼

Passkey authentication in a ColdBox application is implemented using the cbsecurity-passkeys module to handle WebAuthn registration, generate secure authentication challenges, verify assertions, and wire routes to event handlers.

What is WebAuthn passwordless login and how does it prevent phishing?▼

WebAuthn passwordless login uses public-key cryptography and FIDO2 passkeys to authenticate users, preventing phishing by binding authentication to specific HTTPS origins and eliminating password theft vectors.

How do I store and manage WebAuthn credentials in ColdBox?▼

Store WebAuthn credentials in ColdBox using a custom PasskeyStorageService to persist public keys, update sign counts during authentication, list user devices, and revoke compromised passkeys.

Does passkey authentication require HTTPS and secure random nonces?▼

Passkey authentication requires HTTPS origins and secure random nonces to satisfy relying party configuration and ensure challenge generation is cryptographically secure against replay attacks.

Can I add passkey registration to an existing ColdBox site without replacing passwords?▼

You can add passkey registration to an existing ColdBox site by integrating cbsecurity-passkeys alongside current authentication, wiring new routes and handlers for browser interactions and credential lifecycle management.

Related Skills

Explore More Software Engineering Skills→
ColdBoxColdBox

cbsecurity-passkeys

Implement WebAuthn passkey registration and authentication ceremonies for ColdBox applications.

Official
Advanced
zeis974zeis974

email-and-password-best-practices

Configure email verification, password reset, and hashing for Better Auth authentication.

Community
Advanced
ColdBoxColdBox

coldbox-security-implementation

Configure CBSecurity authentication, authorization, and firewall rules for ColdBox apps.

Official
Advanced
AJBcodingAJBcoding
4

moai-security-auth

Implement MFA, WebAuthn, OAuth 2.1, and JWT-based authentication with NextAuth.js 5.x.

Community
Advanced