WebAuthn (and FIDO2, CTAP)

securityprogramming

The browser interface websites call to create and use public-key credentials. CTAP is the protocol between browser and external authenticator; FIDO2 is the umbrella term covering both.

The properties that matter to an implementer: the origin is included in the signed data, so credentials cannot be replayed to a different site; user verification by biometric or device PIN is performed locally and never transmitted, which is the point users most often assume works the other way round; and discoverable credentials allow account selection without a username. Recovery is deliberately out of scope, which is why it is the part every deployment has to design itself - and usually the part that reintroduces the phishable path.

Also known as: web authentication, fido2, ctap, user verification, relying party

← All glossary entries