Skip to content

fix(security): bind WebAuthn ceremonies to server-side state #20

Description

@sign-mark

Summary

The example service accepted the WebAuthn challenge and authenticator data from browser requests during verification. This bypasses the server-side ceremony state required to verify a credential response and safely update an authenticator counter.

Required behavior

  • Require a server-authenticated user session for passkey enrollment and assertion.
  • Store registration and authentication challenges server-side with a timeout and consume them once.
  • Bind each ceremony to the authenticated user.
  • Select credential public keys and counters only from the server-side record for that user.
  • Persist the new counter after successful assertion verification.

Production note

The reference implementation may use process-local state only to demonstrate the required trust boundary. Deployments running multiple processes must replace it and the session store with shared durable storage.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions