# Webauthn support **URL:** https://meta.discourse.org/t/webauthn-support/126454 **Category:** Feature **Tags:** rfc **Created:** [August 21, 2019, 11:20pm UTC](https://meta.discourse.org/t/webauthn-support/126454 "2019-08-21T23:20:40Z") **Posts on this page:** 1 **Showing post:** 1
### Author: ![featheredtoast](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/featheredtoast/32/116994_2.png) [@featheredtoast](https://meta.discourse.org/u/featheredtoast) #### Post date: [August 21, 2019, 11:20pm UTC](https://meta.discourse.org/t/webauthn-support/126454/1 "2019-08-21T23:20:40Z")
# Webauthn RFC This topic aims to document the Discourse project goals around FIDO2 / Webauthn authentication. ### Why? Adding Webauthn support to Discourse will increase the security of user accounts, enabling easily acessible password-less accounts using their devices secure features, like a smartphone fingerprint reader. ### Authentication Methods - Webauthn as a second factor authenticator (act like a Google Authenticator alternative) - Webauthn as a first factor authenticator (act like a social login alternative) - Webauthn as a multi factor authenticator (username-less login) ### #### Webauthn as a second factor authenticator This will allow a Discourse user, who already has an active account to use Webauthn as a 2FA, where today we only support TOTP. Any Webauthn method can work here, be it device biometrics (fingerprint header in Android, Windows Hello laptop), a device secure chip (TPM, secure enclave) or a hardware key (like a [Yubikey](https://www.yubico.com/)). This would be availiable for every user who browses with: - Microsoft Edge on Windows, using Windows Hello (with facial recognition, fingerprint reader, or PIN) - Chrome on macOS, using Touch ID - Android Phone - Laptop/Desktop/Phone + Physical Key (Yubikey, Google Titan) ![webauthn-2fa-mockup](https://global.discourse-cdn.com/meta/original/3X/2/c/2cbeb46ad38e314084d370a8303ad053d0980728.png) #### Webauthn as a first factor authenticator (password-less accounts) Allows a user to sign in to their Discourse account using the Webauthn authentication as an alternative to a password. If a first-factor authenticator is set up, the user will be prompted to use the authenticator in lieu of a password. The same authentication methods for second-factor authentication will work for first-factor authentication: biometrics, secure chip, or hardware key. ##### Register Flow ![image](https://global.discourse-cdn.com/meta/original/3X/0/d/0d2f78e3a43d42ab8e1f0b9b65c71fd4785daf66.png) ![image](https://global.discourse-cdn.com/meta/original/3X/e/4/e4fccc9f8b0d00829cb8ccce1cd1865869a8a10a.png) No password field ![image](https://global.discourse-cdn.com/meta/original/3X/2/6/26dff93090fe3f59ee7fcf380cd0e21ed13b037e.png) ##### Login Flow ![](https://global.discourse-cdn.com/meta/original/3X/e/2/e2c8f69dd68fc99fc51c02a502a639a0d62e08ab.png) ![](https://global.discourse-cdn.com/meta/original/3X/6/4/6413235b21b9f514723297a0da14699d7c23498e.png) ![](https://global.discourse-cdn.com/meta/original/3X/4/9/490bf4aa3ae253cd28b5da154613cbff27fb1ad5.png) #### Webauthn as a multi factor authenticator (username-less logins) Will expose an alternative login method that only prompts for Webauthn input. The registered security key will additionally pass user ID information to the Discourse server. This authentication method currently requires a modern authentication key (eg a Yubikey 5) plus Google Chrome 76+, since it relies in a feature called “Residential Keys”. Since this stores data on the authenticator there can be limits, for example Yubikey 5C can only store up to 25 of those. ##### Register Flow Those flows are an evolution from the one for password-less logins, not a separate login flow. This allows for a iterative implementation. ![image](https://global.discourse-cdn.com/meta/original/3X/0/d/0d2f78e3a43d42ab8e1f0b9b65c71fd4785daf66.png) ![image](https://global.discourse-cdn.com/meta/original/3X/c/6/c613287cb30d3666e2d96292f7731d01cfbea9f2.png) No password field, adds extra checkbox for Residential keys usage ![image](https://global.discourse-cdn.com/meta/original/3X/2/6/26dff93090fe3f59ee7fcf380cd0e21ed13b037e.png) ##### Login Flow ![](https://global.discourse-cdn.com/meta/original/3X/e/2/e2c8f69dd68fc99fc51c02a502a639a0d62e08ab.png) ![image](https://global.discourse-cdn.com/meta/original/3X/9/2/92f83d0760737a48b1e8387c7be968c8b1f0e3aa.png) If the username is left blank we will try to fetch a `user_id` from the autheticator ![](https://global.discourse-cdn.com/meta/original/3X/4/9/490bf4aa3ae253cd28b5da154613cbff27fb1ad5.png) ### References > **[Web Authentication: An API for accessing Public Key Credentials - Level 2](https://www.w3.org/TR/webauthn/)** > **[Web Authentication: An API for accessing Public Key Credentials - Level 3](https://w3c.github.io/webauthn/)** > **[Web Authentication](https://www.yubico.com/authentication-standards/webauthn/)** > > Learn the definition of Web Authentication and get answers to FAQs regarding: What Web Authentication is and how it works. ### Demos > **[Bitwarden Passwordless.dev - Passwordless Authentication | Bitwarden](https://bitwarden.com/products/passwordless/)** > > Embrace passkey & passwordless authentication with Bitwarden Passwordless.dev, empowering devs to build seamless login experiences with standard FIDO passkeys. > **[Web Authentication (WebAuthn) Credential and Login Demo](https://www.webauthn.me/)** > > Try the Web Authentication demo to register a credential and login with biometrics. WebAuthn spec enables public key-based credentials for securely authenticating users using hardware authenticators. [https://webauthndemo.appspot.com/](https://webauthndemo.appspot.com/) [https://webauthn.io/dashboard](https://webauthn.io/dashboard) > **[Yubico demo website](https://demo.yubico.com/webauthn/)** ## Resources [https://github.com/cedarcode/webauthn-ruby](https://github.com/cedarcode/webauthn-ruby) [https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285](https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285) > **[Guide to Web Authentication](https://webauthn.guide/)** > > An introduction to Web Authentication (WebAuthn), the new API that can replace passwords with strong authentication. --- _[View the full topic](https://meta.discourse.org/t/webauthn-support/126454)._