localzet / webauthn
Localzet WebAuthn is a high-performance PHP library designed for working with WebAuthn, a web authentication standard developed by W3C. The library provides secure and reliable user authentication using modern cryptographic methods. It supports PSR-4 autoloading and requires PHP version 8.2 or highe
Fund package maintenance!
Requires
- php: ^8.2
Requires (Dev)
None
Suggests
None
Provides
None
Conflicts
None
Replaces
None
This package is auto-updated.
Last update: 2026-11-07 00:21:34 UTC
README
Security and production status
This library currently does not support live FIDO Metadata Service imports. The previous implementation imported attestation certificates from an unverified JWT and is intentionally disabled until MDS JWT signatures, pinned trust anchors and update semantics are implemented and tested. Bundled local certificates are still loaded, but their provenance and freshness need an independent review before relying on attestation trust.
Always preserve a single-use challenge per credential ceremony and store it server-side for verification. Allowed origins must be HTTPS (except localhost) and their hostnames must match the RP ID exactly or end in .<rp-id>.
Run php tests/security.php after composer install to verify the basic trust boundary checks. A complete WebAuthn conformance suite is still required before production deployment.