Download the PHP package ophelios/php-webauthn-passkey without Composer

PHP WebAuthn Passkey

💿 Installation and dependencies

Install with Composer:

Requirements: PHP >= 8.4

Add the required table into your database. The example below if for PostgreSQL:

Replace the <YOUR USER ID REFERENCE> with the column name of your user identifier.

The identifier column if of type UUID given by gen_random_uuid() which is included in the extension pgcrypto. You can enable it with CREATE EXTENSION IF NOT EXISTS "pgcrypto"; as shown above.

🌱 Usage

Create the broker instance

First, create the broker instance you will use to interact with the database.

If you already have a table and want to use the PRF extension, add the column:

Create your registration Controller

Create your authentication Controller

Add routes exception to the CSRF middleware

Add the following exception pattern to the CSRF middleware in your config.yml file for a Zephyrus-based project.

Front-end module (ESM) for passkey registration and login

We provide an ES module you can use to handle both Passkey registration (create) and authentication (login) with configurable endpoints.

• Module file: backpack/public/javascripts/modules/passkey.js

Registration (create) example with callbacks:

Login (assertion) example with callbacks:

Programmatic usage (no UI binding):

Experimental: PRF-based deterministic seed (opt-in)

• Server exposes a site-scoped PRF input salt when enabled. Instantiate the service with enablePrf: true:

• During registration, a per-passkey 32-byte random salt is generated and stored in prf_salt.

• Clients that opt-in to PRF (prf: { enabled: true }) will request PRF from the authenticator and return the PRF output in clientExtensionResults.prfResults.

• After a successful assertion (or attestation), you can derive a deterministic 32-byte seed on the server from the client PRF output and the stored prf_salt using:

Notes on PRF-derived seed usage:

• Unfortunately, not all authenticators support PRF, as this is a client opt-in extension, you cannot enforce it. I would highly recommend keeping a fallback solution. Currently, only linux-based platform authenticators, macOS/iOS, android and certain authenticator app support PRF.
• The derived PRF output is a stable and cryptographically strong 32-byte material that can be used as a seed for encryption. It is not a secret by itself. And thus, cannot and should not be used as one.