WebAuthn
The browser standard behind passkeys and security keys: a site verifies a signed challenge without ever receiving the private key.
See it
What it is
WebAuthn, a W3C Recommendation since 2019 and the browser half of FIDO2, is the standard that lets a site register and use public-key credentials held by passkeys, platform authenticators, and hardware security keys. The server sends a random challenge, the authenticator signs it for that relying party, and the server verifies the signature with the stored public key. The private key never reaches the site.
Reach for WebAuthn when you want passwordless login or phishing-resistant MFA. Registration uses navigator.credentials.create; authentication uses navigator.credentials.get. The credential is scoped to a relying party ID, so a convincing lookalike domain cannot ask it for a valid signature for your site.
The gotcha is that receiving a PublicKeyCredential is not the same as verifying one. Check the challenge, origin, RP ID hash, ceremony type, signature, and user-present and user-verified flags on the server. The signature counter can be a cloning signal, but authenticators do not all update it, so a zero or unchanged counter is not automatic proof of an attack.
Ask AI for it
Implement WebAuthn registration and authentication with @simplewebauthn/server and @simplewebauthn/browser. Generate every challenge on the server, store it once with a five-minute expiry, and consume it after one ceremony. For registration, set the exact rpID and expected origin, request residentKey 'preferred' and userVerification 'preferred', then store the credential ID, public key, counter, transports, and user ID. For authentication, call navigator.credentials.get through the library and verify challenge, origin, RP ID hash, ceremony type, signature, credential ID, user-present flag, and the configured user-verification policy on the server. Allow multiple credentials per account and add integration tests for a wrong origin, replayed challenge, and unknown credential.