Download the PHP package ihorchyshkala/passkey-plugin without Composer
On this page you can find all versions of the php package ihorchyshkala/passkey-plugin. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download ihorchyshkala/passkey-plugin
More information about ihorchyshkala/passkey-plugin
Files in ihorchyshkala/passkey-plugin
Package passkey-plugin
Short Description WebAuthn/Passkey authentication for October CMS backend
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package passkey-plugin
Passkey Authentication Plugin
WebAuthn/Passkey authentication for the October CMS backend. Lets administrators sign in using fingerprint, face recognition, or screen lock instead of a password.
Features
- Passwordless login — "Sign in with Passkey" button on the backend login page
- Discoverable credentials — no username required, the passkey identifies the user
- Multi-device support — USB security keys, NFC, Bluetooth, hybrid, and platform authenticators
- Per-user management — register, name, and delete passkeys from the user profile tab
- Admin management — users with
admins.managepermission can manage passkeys for other users - Rate limiting — max 10 authentication attempts per minute per IP
- IDOR protection — user context derived from URL parameters and permissions, not POST data
- Signature counter validation — detects cloned authenticators
- 15 languages — Arabic, Chinese, Dutch, English, French, German, Japanese, Korean, Latvian, Polish, Portuguese, Russian, Spanish, Turkish, Ukrainian
Requirements
- October CMS 3.1+ (plugin v1.x) or October CMS 4.x (plugin v2.x)
- PHP 8.0.2+ (v1.x) or PHP 8.2+ (v2.x)
- HTTPS (required by the WebAuthn specification)
- A WebAuthn-capable browser (all modern browsers)
Installation
Via Composer
Via October CMS Marketplace
Search for Passkey Authentication in the October CMS plugin marketplace, or install from the admin panel:
Manual Installation
Clone this repository into plugins/ihorchyshkala/passkey/ and run migrations:
Usage
Signing in with a Passkey
Once a passkey is registered, the login page shows a "Sign in with Passkey" button below the standard login form. Click it, authenticate with your device (fingerprint, face, PIN), and you're in — no password needed.
Registering a Passkey
- Go to Settings → Administrators → (your user) → Passkeys tab, or My Account → Passkeys
- Click Add Passkey
- Give it a descriptive name (e.g. "MacBook Pro", "YubiKey")
- Click Create Passkey and follow the browser prompt
- The passkey appears in the list immediately
Removing a Passkey
Click Remove next to any passkey in the list. A confirmation dialog prevents accidental deletion.
Version Compatibility
| Branch | Plugin | October CMS | PHP | Laravel |
|---|---|---|---|---|
1.x |
v1.x | v3.1+ | >=8.0.2 | 9 / 10 / 11 |
master |
v2.x | v4.x | >=8.2 | 12 |
Composer constraints on october/rain ensure the correct version is installed automatically. The namespace IHORCHYSHKALA\Passkey is the same on both branches.
How It Works
The plugin implements the WebAuthn Level 2 specification using the lbuchs/webauthn PHP library.
Registration flow:
- Backend generates a challenge with user info and excluded credentials
- Browser calls
navigator.credentials.create()with the options - Authenticator creates a key pair and signs the challenge
- Backend verifies the attestation and stores the public key
Authentication flow:
- Backend generates a challenge (no user info — discoverable credentials)
- Browser calls
navigator.credentials.get() - Authenticator signs the challenge with the private key
- Backend verifies the signature against the stored public key and logs the user in
Challenges are stored in the server session with a 120-second TTL and are consumed on use (one-time).
Security
- All credentials are stored server-side; private keys never leave the authenticator
- Challenges expire after 120 seconds and are single-use
- Rate limiting prevents brute-force attempts (10/min per IP)
- User verification is required for both registration and authentication
- Signature counters are validated to detect cloned authenticators
- IDOR protection: user targeting uses URL parameters verified against permissions, not client-supplied POST data
- Generic error messages prevent credential enumeration
Database
The plugin creates one table: ihorchyshkala_passkey_credentials
| Column | Type | Description |
|---|---|---|
id |
int | Primary key |
backend_user_id |
int | Foreign key to backend_users (cascade delete) |
credential_id |
varchar(512) | Base64url-encoded credential ID (indexed) |
public_key |
text | COSE public key |
name |
string | User-given name for the passkey |
sign_count |
int | Signature counter |
transports |
text | JSON array of supported transports |
created_at |
timestamp | |
updated_at |
timestamp |
License
MIT
All versions of passkey-plugin with dependencies
composer/installers Version ~1.0
october/rain Version >=3.1 <4.0
lbuchs/webauthn Version ^2.2