Implementing Passkeys with a PHP WebAuthn Library

WebAuthn passkeys authenticate using origin-bound public-key credentials verified by a relying-party library.

What It Does

WebAuthn passkeys authenticate using origin-bound public-key credentials verified by a relying-party library. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

A maintained WebAuthn relying-party library, HTTPS, a configured RP ID and challenge storage.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Install a WebAuthn relying-party library and the required PSR dependencies.

composer require web-auth/webauthn-lib

This is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.

Example 2: Another Case

Generate a challenge bound to the session and the intended operation; retain it only briefly.

<?php
$challenge = random_bytes(32);
$sessionChallenge = rtrim(strtr(base64_encode($challenge), "+/", "-_"), "=");
echo $sessionChallenge;

Practical Example: Putting It to Use

Do not treat comparison of origin strings or decoding JSON as proof of a valid passkey response.

<?php
$expectedOrigin = "https://login.example.test";
$actualOrigin = "https://login.example.test";
$expectedRpId = "login.example.test";
if ($actualOrigin !== $expectedOrigin) throw new RuntimeException("Origin mismatch");
echo $expectedRpId;
// The library MUST verify the authenticator signature, challenge, RP ID, origin, and user verification.

Important Behavior and Edge Cases

Comparing origin and challenge strings without cryptographic authenticator verification is insecure.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• WebAuthn passkeys authenticate using origin-bound public-key credentials verified by a relying-party library.
• Comparing origin and challenge strings without cryptographic authenticator verification is insecure.
• Use a maintained WebAuthn library for attestation, assertion and counter policies.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.