madwizard/webauthn

Web Authentication API server for PHP

v0.9.1 2023-01-03 14:00 UTC

Requires

• php: ^7.2.0|^8.0
• ext-json: *
• ext-openssl: *
• ext-sodium: *
• guzzlehttp/guzzle: ^6.5|^7.0
• kevinrob/guzzle-cache-middleware: ^3.3
• psr/cache: ^1.0|^2.0|^3.0
• psr/log: ^1.1|^2.0|^3.0
• sop/asn1: ^4.1
• sop/crypto-bridge: ^0.3.1
• sop/crypto-encoding: ^0.3.0
• sop/crypto-types: ^0.3.0
• sop/x501: ^0.6.1
• sop/x509: ^0.7.0
• symfony/cache: ^4.4|^5.2|^6.0

Requires (Dev)

• phpseclib/phpseclib: ^3.0.1
• phpstan/phpstan: ^0.12.64
• phpunit/phpunit: ^8.5.29
• sebastian/comparator: ^3.0.5
• symfony/console: ^5.2
• symfony/dotenv: ^5.2
• symfony/var-dumper: ^5.2

MIT

• Thomas Bleeker

README

Current state

Pretty stable but the API may still change slightly until the 1.0 release.

Goal

This library aims to implement the relying party server of the WebAuthn specification in PHP. Important goals are:

• Implement the level 1 WebAuthn specification
• Good quality, secure and maintainable code
• Easy to use for the end-user

Installation

Installation via composer:

composer require madwizard/webauthn

Supported features

• PHP 7.2

• FIDO conformant library
• Attestation types:
  • FIDO U2F
  • Packed
  • TPM
  • Android SafetyNet
  • Android Key
  • Apple
  • None
  • Optional 'unsupported' type to handle future types
• Metadata service support
• Validating metadata
• Extensions:
  • appid

Usage

The library is still in development so documentation is limited. The general pattern to follow is:

1. Implement CredentialStoreInterface (you will need UserCredential or your own implementation of UserCredentialInterface)
2. Create an instance of RelyingParty and use the ServerBuilder class to build a server object:

$server = (new ServerBuilder())
    ->setRelyingParty($rp)
    ->setCredentialStore($store)
    ->build();

1. Use startRegistration/finishRegistration to register credentials. Be sure to store the temporary AttestationContext server side!
2. and startAuthentication/finishAuthentication to authenticate. Be sure to store the temporary AssertionContext server side!

Resources

WebAuthn specification