asmhatre/spring-auth-demo
1
0
Fork 0
Code Activity

Add passkeys project: WebAuthn ceremonies, a software authenticator and the one-time-token fallback

Browse Source 
Fourth Maven project in the repository. Registration and authentication run end to
end with no browser and no hardware key: VirtualAuthenticator emits real CBOR
attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java
drives the live HTTP endpoints with them.

Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and
JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys
and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
This commit is contained in:
Ankur Mhatre
2026-08-25 22:54:40 +05:30
parent e9381dc5be
commit f6dd692177
59 changed files with 3567 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/output/pk-bootstrap.txt Normal file
View File

@@ -0,0 +1,15 @@
==============================================================================
Bootstrapping - registering a passkey requires an existing authenticated session
==============================================================================
=== Asking for registration options with nobody logged in ===
$ POST /webauthn/register/options (anonymous)
HTTP 400
(empty body)
=== A one-time token for a username that does not exist ===
POST /ott/generate -> HTTP 302, Location: http://localhost:8080/login/ott
a token was still generated and delivered: d75e51fe-cbde-4add-8d70-231fc6ca490f
the response is byte-for-byte what a real username produces - no enumeration oracle
POST /login/ott -> HTTP 302, Location: http://localhost:8080/login?error (the failure lands here instead)