website·Indexed 35 days ago
https://simplewebauthn.dev/docs/A set of complementary libraries for adding WebAuthn-powered authentication to applications. Includes @simplewebauthn/browser for client-side registration and authentication, and @simplewebauthn/server for server-side logic. Supports Node LTS, Deno, and modern browsers, with features covering passkeys, FIDO conformance, and Post-Quantum Cryptography (PQC) ML-DSA support in version 14.0.x.
@simplewebauthn/server for server-side logic and @simplewebauthn/browser for client-side browser interactions.SimpleWebAuthn provides a pair of libraries to simplify the WebAuthn registration and authentication flow. It abstracts the complexity of the W3C WebAuthn specification, specifically handling the conversion between ArrayBuffer/Uint8Array and JSON-compatible formats required for transmission between the front end and back end.
@simplewebauthn/server: Provides methods to generate the required values for registration/authentication and to parse the responses received from the browser.@simplewebauthn/browser: Provides methods to pass server-provided values into the browser's navigator.credentials.create() and navigator.credentials.get() APIs and return the authenticator's response to the server.MetadataService is an opt-in singleton service in @simplewebauthn/server that interacts with the FIDO Alliance Metadata Service (MDS) API (version 3.0). It allows developers to cross-reference authenticators used during registration against cryptographically-signed 'guarantees' provided by manufacturers. This is used to ensure strict adherence to FIDO specifications. Using MetadataService is not required for typical use cases.import { MetadataService } from '@simplewebauthn/server';@simplewebauthn/server for server-side logic and @simplewebauthn/browser for client-side browser interactions.@simplewebauthn/server package provides a MetadataService singleton to interact with the FIDO Alliance Metadata Service (version 3.0) API. This allows developers to cross-reference authenticators during registration using cryptographically-signed guarantees from manufacturers. This functionality is opt-in and not required for typical use cases.import { MetadataService } from '@simplewebauthn/server';SimpleWebAuthn v14.0.x supports the ML-DSA signature algorithm to protect passkeys against future quantum computer attacks. This is available in the following runtimes:
prf (pseudo-random function) extension allows a website to request random bytes associated with a user's passkey, which is useful for end-to-end encryption. However, this creates a critical dependency: if a user deletes their passkey, they will permanently lose access to any information encrypted using that passkey's PRF seed. Because of this risk, SimpleWebAuthn provides minimal helpers rather than a high-level abstraction for PRF.prf (pseudo-random function) extension allows a server to request random bytes associated with a user's passkey, which is useful for end-to-end encryption. However, this creates a critical dependency: if a user deletes their passkey, they permanently lose access to any data encrypted using that passkey's PRF seed. SimpleWebAuthn provides minimal abstraction for PRF to ensure developers understand the liability and the underlying WebAuthn specification.WebAuthn requires a coordinated exchange between a server and a browser to handle registration and authentication. The primary challenge is that the native WebAuthn API (navigator.credentials.create() and navigator.credentials.get()) relies heavily on ArrayBuffer objects, which are not natively JSON-compatible for transmission between the front end and back end.
SimpleWebAuthn solves this by providing two complementary libraries:
Together, these libraries automate the conversion between Uint8Array/ArrayBuffer and JSON-compatible strings, removing the need for manual data transformation.
When attestationType is set to "direct" during registration options generation, the authenticator returns an attestation statement containing verifiable information about the hardware.
SimpleWebAuthn supports all current WebAuthn attestation formats, including: Packed, TPM, Android Key, Android SafetyNet, Apple, FIDO U2F, and None. If you do not have specific requirements regarding the hardware your users use, you can ignore attestation statements.
@simplewebauthn/server package is FIDO conformant as of v0.7.0. This level of authenticator scrutiny is opt-in. To enable it, developers should use the MetadataService.