WebAuthn
WebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
Use public keys in the browser
WebAuthn is a browser API for registering and using cryptographic public-key credentials. Passkeys use this interface on the web. Registration uses navigator.credentials.create(); a subsequent sign-in uses navigator.credentials.get(). The API requires a secure context, usually HTTPS in normal web operation.
Server validation is part of sign-in
A fictional project portal generates a fresh, random challenge for a sign-in attempt. The browser arranges for a signed response. The rpId identifier binds the operation to the intended service. Among other checks, the portal server verifies the signature with the stored public key, the expected challenge and the service binding. The expected origin, comprising the website’s protocol, hostname and port, also belongs in validation.
The object returned by the browser alone is therefore not successful access to the portal. The application accepts authentication only after server validation. In this portal, cancelling the dialog produces no confirmed sign-in; the interface must communicate that state clearly.
WebAuthn does not organise synchronisation between devices or recovery of lost account access. Those flows need separate decisions. Even after successful sign-in, the server still checks which projects the account may open or change.
Sources
Related terms
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- HttpOnly cookieHttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
- Same-origin policyThe same-origin policy limits browser access between different origins. A different page path alone does not create a new origin.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
- Role-based access controlRBAC connects permissions to roles and assigns people to those roles. The data scope must be clear alongside the role name.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.