Download the PHP package milpa/auth-webauthn without Composer

On this page you can find all versions of the php package milpa/auth-webauthn. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of milpa/auth-webauthn

Informations about the package auth-webauthn

Milpa

# Milpa Auth-WebAuthn > Passkey / WebAuthn adapter for the Milpa PHP framework: a > [lbuchs/webauthn](https://github.com/lbuchs/WebAuthn) implementation of `milpa/auth`'s > `WebAuthnVerifier`, plus in-memory challenge and credential stores. [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) [![PHP](https://img.shields.io/badge/php-%E2%89%A5%208.3-777bb4.svg)](https://www.php.net/) **A verified WebAuthn assertion mints a session — it is never a per-request transport.** `milpa/auth-webauthn` sits one tier above [`milpa/auth`](https://github.com/getmilpa/auth): `milpa/auth` owns the ceremony vocabulary (`RelyingParty`, `Contracts\WebAuthnVerifier`, the assertion/registration value objects). This package implements that port with `lbuchs/webauthn` and ships in-memory stores for tests and zero-file consumers. Zero framework, zero ORM. ## Install ## What this package is `milpa/auth-webauthn` is the cryptography adapter for a WebAuthn/FIDO2 ceremony: a `lbuchs/webauthn`-backed `Adapter\LbuchsWebAuthnVerifier` that implements `Milpa\Auth\WebAuthn\Contracts\WebAuthnVerifier` (defined in `milpa/auth`), plus `InMemoryChallengeStore` and `InMemoryWebAuthnCredentialStore` as reference implementations for tests and zero-file consumers. See [ADR 0001](docs/adr/0001-webauthn-mints-a-session.md) for the three decisions this shape commits to. The ceremony types themselves (`RelyingParty`, `WebAuthnAuthenticationResponse`, `WebAuthnAssertionResult`, …) resolve from `milpa/auth`. **A verified assertion mints a session — it is never a per-request transport**, so `WebAuthnVerifier` is deliberately not a `Milpa\Auth\Contracts\CredentialVerifier`. `verifyAuthentication()` returns proof (`WebAuthnAssertionResult`), and the host — not this package — turns that proof into a `Milpa\Auth\SessionRecord` a later request resolves via `Milpa\Auth\Http\StartSession`. ## The shape Registration is the mirror image: `createRegistrationOptions(Actor, RelyingParty, WebAuthnRegistrationContext)` issues a challenge and creation options; `verifyRegistration(WebAuthnRegistrationResponse, RelyingParty)` verifies the (`'none'`) attestation and returns a `WebAuthnCredentialRecord` for the host to `save()`. ## The three seams a host implements | Contract | Its one job | |---|---| | `ChallengeStore` | `issue`/`consume` a single-use, expiring `ChallengeRecord` between a ceremony's two round-trips. | | `WebAuthnCredentialStore` | `save`/`findByCredentialId`/`listForActor`/`updateSignCount` — the registered-passkey registry. | | `RelyingPartyResolver` | `resolve(ServerRequestInterface): RelyingParty` — which RP a request's ceremony runs under (host-header, tenant path, …), never a single env-static value. | `InMemoryChallengeStore` and `InMemoryWebAuthnCredentialStore` are the reference implementations — array-backed, with an injectable clock, good for tests and zero-file consumers. Neither is safe for a clustered production deployment: **`ChallengeStore::consume()` MUST be atomic (delete-on-read) in any production implementation**, or a challenge issued once could be read and reused by two concurrent requests before either commits its removal. A host ships its own store (Doctrine, Redis, …) behind the same contract for that guarantee. ## Non-goals, stated on purpose - **No enterprise attestation.** The shipped adapter fixes attestation to `'none'` — it proves possession of a key bound to the RP, not the authenticator's make/model/manufacturer chain. Verifying a specific authenticator's provenance is a **future adapter** behind the same `WebAuthnVerifier` port (see [ADR 0001](docs/adr/0001-webauthn-mints-a-session.md)), not a mode flag on this one. - **No auth-strength on `Actor`.** This package does not add a "how strongly was this actor authenticated" field to `milpa/auth`'s `Actor` or `AuthContext`. `CredentialType::Passkey` is a vocabulary marker for logs, UI, and reports — not a policy input `milpa/auth` exposes today. - **No `Credential::passkey()` factory.** A passkey ceremony is stateful and two-round-trip, never a single-shot secret a `CredentialVerifier` checks. Passkey exists as a credential type in the vocabulary, not as a per-request `Credential` factory. ## Requirements - PHP **≥ 8.3** - `milpa/auth` `^0.9` (ceremony types, contracts, and the identity vocabulary) - `lbuchs/webauthn` `^2` (the shipped cryptography adapter) - `psr/http-message` (the `RelyingPartyResolver` seam) - `ext-openssl`, `ext-mbstring`, `ext-sodium` ## License [Apache-2.0](LICENSE) © Rodrigo Vicente - TeamX Agency. --- Milpa is developed and maintained by [TeamX Agency](https://teamx.agency).

All versions of auth-webauthn with dependencies

PHP Build Version
Package Version
Requires php Version >=8.3
milpa/auth Version >=0.9 <1.0
lbuchs/webauthn Version ^2
psr/http-message Version ^1 || ^2
ext-openssl Version *
ext-mbstring Version *
ext-sodium Version *
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package milpa/auth-webauthn contains the following files

Loading the files please wait ...