Download the PHP package padosoft/laravel-rebel-bridge-passkeys without Composer

On this page you can find all versions of the php package padosoft/laravel-rebel-bridge-passkeys. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of padosoft/laravel-rebel-bridge-passkeys

Informations about the package laravel-rebel-bridge-passkeys

laravel-rebel-bridge-passkeys

Official documentation: https://doc.laravel-rebel.padosoft.com

WebAuthn passkey step-up driver for Laravel Rebel.

Bridges spatie/laravel-passkeys (or any WebAuthn library you prefer) into Rebel's step-up DriverRegistry, giving you a phishing-resistant (AAL2) step-up factor with one composer require and two lines of configuration.

CI PHPStan

Glossary

Before diving in, here are the terms you will encounter throughout this README.

Term What it means
Passkey A cryptographic credential stored in a hardware-backed secure enclave (phone, laptop TPM, YubiKey). You use it with Face ID, fingerprint, or a PIN. No password involved.
WebAuthn / FIDO2 The W3C + FIDO Alliance standard that defines how browsers talk to authenticators. Passkeys are WebAuthn credentials.
Phishing-resistant An assertion is cryptographically bound to the exact origin (domain + protocol) of the page that called navigator.credentials.get(). A phishing site on a different domain literally cannot capture and replay a valid assertion — the signature simply won't verify. OTP/TOTP/SMS are NOT phishing-resistant.
AAL2 (phishing-resistant) NIST SP 800-63B Authenticator Assurance Level 2. This driver declares AAL2 + phishing-resistant: a passkey can't be phished, but most consumer passkeys are synced across a vendor cloud (iCloud Keychain, Google Password Manager) rather than hardware-bound, so strict NIST reserves AAL3 for device-bound/security-key authenticators only. The honest default is AAL2-phishing-resistant; a deployment that mandates device-bound passkeys can raise it.
AMR Authentication Methods Reference — a list of short strings (e.g. ['webauthn']) that describe HOW the user authenticated. Used by compliance and audit systems.
Step-up An in-session re-authentication challenge. The user is already logged in; before a sensitive action (e.g. changing payment method, approving a transfer) you ask them to confirm their identity again using a strong factor.
DriverRegistry The Rebel step-up registry. Each package contributes its own driver (email-OTP, TOTP, passkey…). The Rebel core selects the right driver for a given purpose/assurance policy.
PasskeyChallenger The seam (interface) in this bridge. It decouples the driver logic from any specific WebAuthn library.

How a passkey step-up works (step by step)

Replay protection: the nonce issued in step 2 is stored as the step-up reference. Even if an attacker intercepts the signed assertion in step 5, they cannot replay it — verifyAssertion() will reject it because the nonce has already been consumed (or a new nonce will be different).

Phishing protection: the browser signs the assertion with the private key only for the exact origin that issued the challenge. If you host pay.example.com and an attacker sets up pay-examp1e.com, the assertion from the real device is cryptographically bound to pay.example.com and will NOT verify on the phishing domain.

Requirements

Optional (for the built-in Spatie adapter):

Installation

1. Install the bridge

The package auto-discovers and registers its service provider. No manual registration needed.

2. Bind a PasskeyChallenger

The bridge ships with a production adapter for spatie/laravel-passkeys. Install it:

Then bind the adapter in your AppServiceProvider:

3. Add HasPasskeys to your User model

4. Publish the config (optional)

Bringing your own WebAuthn library

Not using spatie/laravel-passkeys? No problem. Implement the PasskeyChallenger interface against your preferred library (e.g. web-auth/webauthn-framework) and bind it:

The interface you need to implement:

Configuration

config/rebel-bridge-passkeys.php:

Key Environment variable Type Default Description
drivers.passkeys REBEL_PASSKEYS_DRIVER_PASSKEYS bool true Enable the 'passkeys' step-up driver. The driver is only registered when this is true AND a PasskeyChallenger is bound in the container. Set to false to disable the driver without unbinding the challenger.

Usage examples

Example 1 — Protect a route with a passkey step-up

Example 2 — Manual step-up in a controller

Example 3 — Check if the driver is available before showing the UI

Example 4 — Testing with FakePasskeyChallenger

Audit events

Every step-up action is recorded to rebel_auth_events via the core AuditLogger. The following events are emitted so that the step-up funnel, compliance AMR breakdown, and audit explorer panels in the Rebel admin all light up:

Event type When channel amr aal
stepup.passkeys.started A challenge was issued via start() passkey ['webauthn'] aal2
stepup.passkeys.verified Assertion verified successfully passkey ['webauthn'] aal2
stepup.passkeys.failed Assertion rejected, missing reference, or any exception passkey ['webauthn'] aal2

All events include subjectType and subjectId (the authenticated user's class and ID). The raw WebAuthn assertion and credential bytes are never included in any audit field.

Competitor card-battle table

How does passkey-based phishing-resistant (AAL2) step-up compare to what other platforms offer?

Feature Laravel Rebel (this package) Laravel Fortify (plain) Shopify Auth0 Okta
Passkey / WebAuthn step-up ✅ AAL2, phishing-resistant ❌ No step-up system ❌ No developer step-up API ⚠️ Enterprise tier only ⚠️ Paid addon
Phishing-resistant by spec ✅ Origin-bound by design ❌ ❌ ✅ (if enabled) ✅ (if enabled)
AMR / AAL in audit trail ✅ ['webauthn'], AAL2 ❌ No standard audit ❌ ⚠️ OIDC claims only ⚠️ OIDC claims only
Bring your own WebAuthn lib ✅ Any library via PasskeyChallenger ❌ ❌ ❌ ❌
Works without Fortify ✅ Zero Fortify dependency N/A N/A N/A N/A
Offline tests (no browser) ✅ FakePasskeyChallenger ❌ ❌ ❌ ❌
Step-up funnel analytics ✅ started/verified/failed events ❌ ❌ ⚠️ Paid dashboard ⚠️ Paid dashboard
Open source / MIT ✅ ✅ (no step-up) ❌ Closed SaaS ❌ Closed SaaS ❌ Closed SaaS

Vibe coding with batteries included

This package ships everything an AI agent or a new contributor needs to keep working productively:

Dev loop

Quick start for contributors

Package structure

License

MIT — see LICENSE.

Part of the Laravel Rebel enterprise-auth suite by Padosoft.

All versions of laravel-rebel-bridge-passkeys with dependencies

PHP Build Version
Package Version
Requires php Version ^8.3
illuminate/contracts Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
padosoft/laravel-rebel-core Version ^0.1
padosoft/laravel-rebel-step-up Version ^0.1
spatie/laravel-package-tools Version ^1.92
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package padosoft/laravel-rebel-bridge-passkeys contains the following files

Loading the files please wait ...