Class: FIDO2Strategy

Defined in: auth/src/auth/FIDO2Strategy.ts:90

Implements an authentication strategy for performing FIDO2 hardware security key (e.g. YubiKey) login via WebAuthn/CTAP2. Functionally this is the same WebAuthn protocol used by PasskeyStrategy — the distinction is one of intent and configuration (see PasskeyConfig.authenticatorAttachment/ residentKey): a FIDO2 hardware key is typically registered as a "cross-platform", non-discoverable credential tied to a known account, rather than a discoverable, possibly-synced passkey.

The login flow has two phases:

1. Challenge - The client requests a challenge. A random challenge is generated and stored in the session, and the resulting options are returned for use with navigator.credentials.get().
2. Verify - The client submits the signed assertion response. The response is verified against the stored challenge and the credential's public key, the credential's signature counter is updated, and the associated user is resolved via verify().

NOTE: Requires session support!

Implements

• AuthStrategy

Constructors

Constructor

new FIDO2Strategy(options): FIDO2Strategy

Defined in: auth/src/auth/FIDO2Strategy.ts:94

Parameters

options

FIDO2StrategyOptions

Returns

FIDO2Strategy

Properties

name

readonly name: string = "fido2"

Defined in: auth/src/auth/FIDO2Strategy.ts:91

The unique name of the strategy used to register with the AuthMiddleware.

Implementation of

AuthStrategy.name

Methods

authenticate()

authenticate(req, res, required?): Promise<AuthResult | undefined>

Defined in: auth/src/auth/FIDO2Strategy.ts:98

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

Parameters

req

HttpRequest

The request containing data to attempt authentication with.

res

HttpResponse

The response to use when writing back directly to the client.

required?

boolean

Returns

Promise<AuthResult | undefined>

Implementation of

AuthStrategy.authenticate

---

authenticateSync()

authenticateSync(req, res, required?): AuthResult | undefined

Defined in: auth/src/auth/FIDO2Strategy.ts:110

Attempts to perform authentication with the given request data. If authentication was successful, returns an AuthResult containing the authentication details. If authentication fails and required is set to true throws an error, otherwise returns undefined.

This is the synchronous version of authenticate that performs blocking based authentication.

Parameters

req

HttpRequest

The request containing data to attempt authentication with.

res

HttpResponse

The response to use when writing back directly to the client.

required?

boolean

Returns

AuthResult | undefined

Implementation of

AuthStrategy.authenticateSync

---

challenge()

protected challenge(req, res): Promise<undefined>

Defined in: auth/src/auth/FIDO2Strategy.ts:122

Begins a login ceremony: generates a challenge, stores it in the session, and writes the resulting options directly to the response for the client to pass to navigator.credentials.get().

Parameters

req

HttpRequest

The source HTTP request. May optionally carry a uid query parameter to scope the allowed credentials to a known user; omitted entirely for a discoverable/"usernameless" flow.

res

HttpResponse

The response to write the generated options to.

Returns

Promise<undefined>

---

verify()

protected verify(req, required?): Promise<AuthResult | undefined>

Defined in: auth/src/auth/FIDO2Strategy.ts:166

Finishes a login ceremony: verifies the client-submitted assertion response against the stored challenge and credential, updates the credential's signature counter, and resolves the associated user.

Parameters

req

HttpRequest

The source HTTP request, carrying the assertion response in its body.

required?

boolean

Set to true if authentication is required to pass, otherwise set to false.

Returns

Promise<AuthResult | undefined>