Package com.codename1.backend.security.webauthn

package com.codename1.backend.security.webauthn

Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

http.webAuthn(...) turns them on for a chain and serves the two ceremonies -- registering a passkey for a user who is signed in, and signing in with one. Behind those endpoints is WebAuthnRelyingPartyOperations, which makes the options a client starts a ceremony from and verifies what the authenticator answered; an application that serves the ceremonies at addresses of its own uses it directly.

What is kept is a CredentialRecord for each passkey, in a UserCredentialRepository, and for each user the handle authenticators know them by, in a PublicKeyCredentialUserEntityRepository: both in memory or in the server's database. Neither holds a secret.

The options and the answers travel as the specification's JSON forms, byte strings in base64url, which is what a browser's PublicKeyCredential.parseCreationOptionsFromJSON and toJSON(), and the Codename One client's com.codename1.io.webauthn.WebAuthnClient, read and write.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.

Class	Description
CoseKey	A credential's public key as an authenticator sends it -- a COSE_Key, RFC 9052 -- turned into what Crypto.verify(String, byte[], byte[], byte[]) takes: an algorithm name and a SubjectPublicKeyInfo.
CredentialRecord	One registered passkey: what the server keeps of a credential, as the WebAuthn specification's credential record lists it.
CredentialRecord.Builder	Builds a CredentialRecord.
InMemoryPublicKeyCredentialUserEntityRepository	User handles kept in this process: gone when it stops, so that every passkey registered before then finds no user after.
InMemoryUserCredentialRepository	Credentials kept in this process: gone when it stops, and unknown to any other server.
JdbcPublicKeyCredentialUserEntityRepository	User handles kept in the server's database, in the cn1_webauthn_user table of SecuritySchema.
JdbcUserCredentialRepository	Credentials kept in the server's database, in the cn1_webauthn_credential table of SecuritySchema.
PublicKeyCredentialCreationOptions	What a client is given to make a passkey with: the relying party, the user, a challenge, and what kind of credential is wanted.
PublicKeyCredentialRequestOptions	What a client is given to sign in with a passkey: a challenge, the relying party, and -- when the user said who they are first -- which credentials may answer.
PublicKeyCredentialRpEntity	The relying party of a passkey: the site a credential belongs to.
PublicKeyCredentialUserEntity	A user as passkeys know them: the name they sign in with, and the user handle -- random bytes that stand for the account inside an authenticator, and that a sign-in without a user name hands back.
PublicKeyCredentialUserEntityRepository	Where each user's passkey handle is kept; see PublicKeyCredentialUserEntity.
UserCredentialRepository	Where the passkeys users have registered are kept.
WebAuthnAuthentication	Who signed in with a passkey.
WebAuthnException	A passkey ceremony that was refused, with which check refused it.
WebAuthnRelyingPartyOperations	The two passkey ceremonies, as the relying party performs them: making the options a client starts from, and verifying what the authenticator answered.
WebAuthnRelyingPartyOperations.Assertion	A verified sign-in.
WebAuthnRelyingPartyOperations.SignatureCounterListener	Told when a signature counter did not advance.