Summary
The example service accepted the WebAuthn challenge and authenticator data from browser requests during verification. This bypasses the server-side ceremony state required to verify a credential response and safely update an authenticator counter.
Required behavior
- Require a server-authenticated user session for passkey enrollment and assertion.
- Store registration and authentication challenges server-side with a timeout and consume them once.
- Bind each ceremony to the authenticated user.
- Select credential public keys and counters only from the server-side record for that user.
- Persist the new counter after successful assertion verification.
Production note
The reference implementation may use process-local state only to demonstrate the required trust boundary. Deployments running multiple processes must replace it and the session store with shared durable storage.
Summary
The example service accepted the WebAuthn challenge and authenticator data from browser requests during verification. This bypasses the server-side ceremony state required to verify a credential response and safely update an authenticator counter.
Required behavior
Production note
The reference implementation may use process-local state only to demonstrate the required trust boundary. Deployments running multiple processes must replace it and the session store with shared durable storage.