asmhatre/spring-auth-demo
1
0
Fork 0
Code Activity

Add passkeys project: WebAuthn ceremonies, a software authenticator and the one-time-token fallback

Browse Source 
Fourth Maven project in the repository. Registration and authentication run end to
end with no browser and no hardware key: VirtualAuthenticator emits real CBOR
attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java
drives the live HTTP endpoints with them.

Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and
JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys
and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
This commit is contained in:
Ankur Mhatre
2026-08-25 22:54:40 +05:30
parent e9381dc5be
commit 6535ca9343
59 changed files with 3562 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
passkeys/src/main/resources/application-attestationdirect.yaml Normal file
View File

@@ -0,0 +1,7 @@
# Ask the authenticator for DIRECT attestation instead of the default NONE.
#
# Registration still succeeds against an authenticator that answers with fmt "none" and an
# all-zero AAGUID, because the default WebAuthnManager verifies no attestation statement at
# all. Asking is not checking.
demo:
attestation-direct: true