webauthn

lbuchs WebAuthn is a small, dependency-light PHP server library that implements the WebAuthn (FIDO2) relying-party workflow. It lets you protect logins with passkeys, hardware security keys like YubiKey or SoloKey, Android fingerprint, Windows Hello, and Apple authenticators - without a password.

The library deliberately stays understandable and self-contained: it generates the challenge arguments your JavaScript passes to the browser’s credential APIs, then verifies the resulting attestation and assertion responses on the server, validating signatures across the major attestation statement formats.

What You Get

• A single WebAuthn class implementing the relying-party registration and authentication flows
• Challenge/argument generation for the browser credential create and get APIs
• Server-side verification of attestation and assertion responses
• Support for android-key, android-safetynet, apple, fido-u2f, packed, tpm, and none formats
• A self-contained CBOR and X.509 handling stack with no heavy dependencies

Common Use Cases

• Adding passwordless passkey login to a PHP application
• Implementing FIDO2 hardware security keys as a second factor
• Supporting Windows Hello, Touch ID, and Android biometric login
• Building a standards-compliant WebAuthn relying party from scratch

Under The Hood

Architecture - The public WebAuthn\WebAuthn class (src/WebAuthn.php) drives the four-step relying-party flow, delegating attestation parsing to per-format classes under src/Attestation, low-level COSE/CBOR decoding to src/CBOR, and byte handling to src/Binary; errors surface through a dedicated WebAuthnException. Tech Stack - Pure PHP >=7.1 with no third-party runtime dependencies, relying on the openssl extension for certificate and signature verification and its own CBOR implementation for authenticator data. Code Quality - The project prioritizes being small and readable over feature sprawl, ships a _test harness demonstrating the full flow, and covers all common attestation formats, though maintenance cadence is low since the standard is stable. API Design - The four-method surface (getCreateArgs/processCreate, getGetArgs/processGet) maps directly onto the WebAuthn spec’s client/server handshake, so the library reads as a thin, honest wrapper over the protocol rather than an opinionated framework.