spb/tools-spboucher-ai

1{2  "slug": "webauthn",3  "name": "Web Authentication (WebAuthn)",4  "aliases": ["WebAuthn", "Web Authentication API", "FIDO2 WebAuthn"],5  "vendor": { "name": "W3C Web Authentication Working Group (with the FIDO Alliance)", "slug": "w3c", "website": "https://www.w3.org" },6  "homepage_url": "https://www.w3.org/TR/webauthn-3/",7  "docs_url": "https://webauthn.io/",8  "repo_url": "https://github.com/w3c/webauthn",9  "product_type": "specification",10  "product_status": "active",11  "summary": "W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication",12  "description": "Web Authentication is a W3C specification, developed by the Web Authentication Working Group in coordination with the FIDO Alliance, that defines a JavaScript API through which web applications ask the browser to create and use public-key credentials bound to an origin. Level 2 became a W3C Recommendation in 2021 and Level 3 reached Recommendation status on 25 August 2026. Together with the FIDO Alliance's Client to Authenticator Protocol (CTAP), which governs how browsers talk to security keys and phones, it forms FIDO2.\n\nA relying party sends a challenge; the authenticator, whether a platform authenticator such as Touch ID or Windows Hello or a roaming key such as a YubiKey, signs it with a private key that never leaves the device, and the server verifies the signature against the stored public key. Credentials are scoped to the origin, which defeats phishing, and discoverable credentials synchronized across a user's devices are what consumer platforms market as passkeys. Server-side libraries exist for most languages, identity providers such as Keycloak and authentik implement it, and password managers like 1Password act as authenticators.\n\nAdoption still depends on browser, operating-system and authenticator support for individual features, on account-recovery design when devices are lost, and on relying parties implementing attestation and user verification policies correctly.",13  "capabilities": ["Origin-bound public-key credential creation and assertion through the browser", "Platform and roaming authenticators (biometrics, PINs, security keys)", "Discoverable, synchronized credentials (passkeys) and multi-device credentials", "Attestation formats and user-verification requirements for relying parties", "Extensions such as PRF for deriving secrets"],14  "workflows": ["Add passwordless or second-factor login to a web application with a server library", "Enable passkeys in an identity provider for all federated applications", "Require hardware keys for administrative accounts"],15  "advantages": ["Phishing-resistant by construction through origin binding", "Supported by all major browsers and operating systems", "Royalty-free open standard"],16  "limitations": ["Feature support varies across browsers, platforms and authenticators", "Account recovery must be designed separately", "Attestation and policy handling add server-side complexity"],17  "prerequisites": ["HTTPS origin", "A server-side library to verify registrations and assertions"],18  "audiences": ["Web developers implementing authentication", "Identity and security architects"],19  "alternatives": ["keycloak", "authentik", "1password"],20  "comparison_notes": "WebAuthn is a specification rather than a product; Keycloak and authentik are identity providers that implement it, and 1Password and other password managers act as passkey authenticators. Listing them as alternatives reflects the different ways a team adopts the standard.",21  "categories": [{ "slug": "identity-access", "primary": true }],22  "tags": ["passkeys", "fido2", "authentication", "web-standard", "security", "specification"],23  "use_cases": ["secure-applications", "manage-identity"],24  "operating_systems": ["any"],25  "execution_modes": ["local"],26  "interfaces": ["api"],27  "deployment_models": ["embedded"],28  "integrations": ["CTAP2", "Keycloak", "authentik", "1Password", "Bitwarden", "Apple Passkeys", "Windows Hello"],29  "data_formats": ["CBOR", "COSE keys", "JSON"],30  "languages": ["JavaScript"],31  "source_model": "open-source",32  "pricing_model": ["free"],33  "self_hostable": null,34  "sources": [35    { "url": "https://www.w3.org/TR/webauthn-3/", "type": "official_site", "title": "Web Authentication: An API for accessing Public Key Credentials, Level 3", "supports": ["name", "summary", "description", "product_status"], "checked_at": "2026-11-02", "note": "W3C Recommendation dated 25 August 2026, published by the Web Authentication Working Group." },36    { "url": "https://github.com/w3c/webauthn", "type": "repository", "title": "w3c/webauthn", "supports": ["source_model"], "checked_at": "2026-11-02", "note": "Documents licensed under the W3C Document License." },37    { "url": "https://webauthn.io/", "type": "official_docs", "title": "webauthn.io demo and guide", "supports": ["workflows", "capabilities"], "checked_at": "2026-11-02" },38    { "url": "https://fidoalliance.org/specifications/", "type": "official_docs", "title": "FIDO Alliance Specifications", "supports": ["vendor", "integrations"], "checked_at": "2026-11-02" }39  ],40  "confidence": "high",41  "uncertainty_note": "license_spdx omitted: the specification text is under the W3C Document License, which is not a software license.",42  "discovery_method": "editorial-research",43  "depth": "standard",44  "editorial_status": "reviewed",45  "visibility": "public",46  "featured": false,47  "author": "batch-B2"48}49