Download the PHP package misakstvanu/laravel-fortify-passkeys without Composer

[!WARNING]
This project is currently under development

Laravel Passkeys

This package provides a simple way to authenticate users using passkeys.

Authentication processes are based on web-auth/webauthn-lib package. On frontend, the opposite functionality is provided by @simplewebauthn/browser package.

Installation

1. Install the package via composer:

2. Service provider will be auto discovered. If you want to register it manually, add the following line to your config/app.php

3. Publish migration to create passkeys table:

4. (optional) Publish the config file:

Configuration

1. Implement an interface Misakstvanu\LaravelFortifyPasskeys\Contracts\PasskeyAuthentication on your User model:

2. Set up passkeys relation on your User model:

3. Once you have published the config file, you can configure the package by editing the config/passkeys.php file. The variables are:

• user_model - the model that will be used to authenticate the user. Default: App\Models\User
• route_prefix - prefix for the 4 routes this package loads. Default: passkeys
• route_middleware - middleware that will be applied to the routes. Default: ['web']
• username_column - the column that will be used to find the user. Default: email
• relying_party_ids - an array of domains that will be allowed insecure connection, use with caution. Default: []
• registration_user_validation - validation rules that will be applied to the request when registering new user. These values will then be persisted with the new user. Default: []

Setting Environment Variables

To make the configuration more flexible, you can set the configuration values using environment variables. Here are the environment variables you can set:

• PASSKEYS_USER_MODEL - the model that will be used to authenticate the user. Default: App\Models\User
• PASSKEYS_ROUTE_PREFIX - prefix for the 4 routes this package loads. Default: passkeys
• PASSKEYS_ROUTE_MIDDLEWARE - middleware that will be applied to the routes. Default: web
• PASSKEYS_USERNAME_COLUMN - the column that will be used to find the user. Default: email
• PASSKEYS_RELYING_PARTY_IDS - a comma-separated list of domains that will be allowed insecure connection, use with caution. Default: ``
• PASSKEYS_REGISTRATION_USER_VALIDATION - a comma-separated list of validation rules that will be applied to the request when registering new user. Default: ``

Examples

Here are some examples of how to set the environment variables in your .env file:

Usage

There are now 6 named routes that make everything work:

POST 'passkeys.login.start' - login route, accepts email or other field specified in your config. If a user with the given username/email exists and has a passkey registered, credential request options will be returned. If the user does not exist, HTTP 404 will be returned instead.

POST 'passkeys.login.verify' - login route, accepts passkey response. If the passkey authentication passes, the user will be logged in. If the passkey authentication fails, an exception with additional information is thrown.

POST 'passkeys.register.start' - registration route, accepts email or other field specified in your config. Credential request options is returned.

POST 'passkeys.register.verify' - registration route, accepts passkey response. If the passkey registration passes, an account will be created from the username/email and any additional data specified in config and sent along with this request. If the passkey registration fails, an exception with additional information is thrown.

POST 'passkeys.add.options' - add passkey route, generates options to add a new passkey to a logged-in user.

POST 'passkeys.add' - add passkey route, accepts passkey response. If the passkey registration passes, the passkey will be added to the existing account. If the passkey registration fails, an exception with additional information is thrown.

JS Example

Below is minimal example of how to use this package with js @simplewebauthn/browser.

Refactoring

The code has been refactored to reduce duplication and follow Laravel best practices. A new service class PasskeyService has been created to handle common logic for generating options and verifying responses. The generateOptions and verify methods in AddPasskeyController, RegistrationController, and AuthenticationController have been refactored to use PasskeyService.

PasskeyService

The PasskeyService class is located in src/Services/PasskeyService.php. It contains the following methods:

• generateOptions(Request $request, $user = null): array - Generates options for passkey creation.
• verify(Request $request, ServerRequestInterface $serverRequest, $user = null): array - Verifies the passkey response.

Controllers

The generateOptions and verify methods in the following controllers have been refactored to use PasskeyService:

• AddPasskeyController
• RegistrationController
• AuthenticationController

The PasskeyService is injected into the constructors of these controllers and used to handle the common logic for generating options and verifying responses.

Response Array

The response has been updated to return an array with "verified". This change has been applied to the verify methods in the AddPasskeyController, RegistrationController, and AuthenticationController. The updated response is as follows: