https://github.com/rozd/passage-webauthn
WebAuthn passkey implementation for Vapor Passage authentication framework.
https://github.com/rozd/passage-webauthn
authentication passage vapor webauthn
Last synced: 14 days ago
JSON representation
WebAuthn passkey implementation for Vapor Passage authentication framework.
- Host: GitHub
- URL: https://github.com/rozd/passage-webauthn
- Owner: rozd
- License: mit
- Created: 2026-04-19T11:53:09.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-05-03T19:29:40.000Z (about 2 months ago)
- Last Synced: 2026-05-03T21:22:03.569Z (about 2 months ago)
- Topics: authentication, passage, vapor, webauthn
- Language: Swift
- Homepage:
- Size: 46.9 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# passage-webauthn
[](https://github.com/rozd/passage-webauthn/releases)
[](https://swift.org)
[](LICENSE)
[](https://codecov.io/gh/rozd/passage-webauthn)
WebAuthn passkey implementation for [Passage](https://github.com/vapor-community/passage) authentication framework.
This package provides a bridge between Passage and [webauthn-swift](https://github.com/swift-server/webauthn-swift), enabling passwordless passkey authentication (registration and assertion) backed by the W3C WebAuthn standard.
> **Note:** This package cannot be used standalone. It requires both [Passage](https://github.com/vapor-community/passage) and [webauthn-swift](https://github.com/swift-server/webauthn-swift) packages to function.
## Installation
Add the package to your `Package.swift`:
```swift
dependencies: [
.package(url: "https://github.com/rozd/passage-webauthn.git", from: "0.0.1"),
]
```
Then add `PassageWebAuthn` to your target dependencies:
```swift
.target(
name: "App",
dependencies: [
.product(name: "PassageWebAuthn", package: "passage-webauthn"),
]
)
```
## Configuration
Configure `WebAuthnPasskeyService` with your relying-party details:
```swift
import Passage
import PassageWebAuthn
import WebAuthn
let passkeyService = WebAuthnPasskeyService(
configuration: .init(
relyingPartyID: "example.com",
relyingPartyName: "My App",
relyingPartyOrigin: "https://example.com"
)
)
```
Then pass it to Passage during configuration:
```swift
try await app.passage.configure(
services: .init(
store: store,
emailDelivery: emailDelivery,
phoneDelivery: phoneDelivery,
passkey: passkeyService,
// ... other services
),
configuration: .init(
passkey: .init(
policy: .init(
timeout: .seconds(60),
attestation: .none,
userVerification: .required,
supportedAlgorithms: [.ES256, .RS256]
)
),
// ... other configuration
)
)
```
## How It Works
PassageWebAuthn implements the four-step WebAuthn ceremony on behalf of Passage:
| Step | Method | Description |
|------|--------|-------------|
| 1 | `beginRegistration` | Generates `PublicKeyCredentialCreationOptions` and a short-lived challenge |
| 2 | `finishRegistration` | Verifies attestation, extracts the new credential, and maps it to a `PasskeyCredential` |
| 3 | `beginAuthentication` | Generates `PublicKeyCredentialRequestOptions` and a short-lived challenge |
| 4 | `finishAuthentication` | Verifies the assertion signature and returns updated sign-count and backup state |
Challenges are managed by Passage core (stored and looked up via the `lookupChallenge` callback); this package only handles the cryptographic verification layer.
## Relying Party Configuration
| Parameter | Description |
|-----------|-------------|
| `relyingPartyID` | Your domain (e.g. `example.com`). Must match the origin without scheme or port. |
| `relyingPartyName` | Human-readable app name shown by the authenticator UI. |
| `relyingPartyOrigin` | Full origin of your app (e.g. `https://example.com`). |
## Passkey Policy
The `Passage.Configuration.Passkey.Policy` passed to each method controls:
| Option | Values | Description |
|--------|--------|-------------|
| `userVerification` | `.required`, `.preferred`, `.discouraged` | Whether PIN/biometric is required |
| `attestation` | `.none`, `.indirect`, `.direct`, `.enterprise` | Attestation conveyance preference |
| `timeout` | `Duration?` | Browser ceremony timeout (e.g. `.seconds(60)`) |
| `supportedAlgorithms` | `[COSEAlgorithmIdentifier]` | Accepted public key algorithms (e.g. `.ES256`, `.RS256`). Algorithms unsupported by `swift-webauthn` (`.EdDSA`, `.ESP256`, `.ESP384`, `.ESP512`) are silently dropped. |
## Requirements
- Swift 6.3+
- macOS 13+ / Linux
- Passage 0.5.1+
- Vapor 4.119+
- webauthn-swift 1.0.0-beta.1+
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.