How we can implement biometric authentication for web.

Đang mở
  • Có gì không ổn?
#46 2 bình luận 0 reaction 1 người được giao Xem trên GitHub

@TheKalpeshPawar đang làm issue này rồi.

Từ ngày 23/7/2025.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

What do we want to achieve?

  • We want the user to be able to authenticate themselves using biometrics or the PIN/Password used by their device each time they open the web app.

How can we achieve this on the web?

Can we achieve exactly what we want with this API?

  • Yes, but not exactly. This technology isn’t intended to be used for unlocking your web app every time a user opens it. That said, there’s no hard rule preventing it. We can just ask for the passkey each time the user tries to open the web app.
  • We can create a passkey using this API. ( We are doing the same thing on Windows, using a different API, using the same technology. But it is still more aligned with our goal.
    • We can use passkeys as a 2FA method for signing into our accounts, like a Google account, a Microsoft account, etc.
  • There are several ways we can create a passkey.
    • We can use a password manager like ProtonPass (which I use).
    • Then there are platform authenticators, which are what we want, like Windows Hello on Windows.
    • The WebAuthN API can call the platform's native authentication APIs, but support varies across platforms, e.g there is no support on Linux for platform authentication.
    • But in any case, the user can use a password manager, a security key and all methods supported by the WebAuthN API.
  • Please refer to the API documentation (WebAuthN).
    • Here is an AI-generated summary of the Introduction section.
    The Web Authentication (WebAuthn) specification defines an API that allows web applications to use strong, 
    public key-based credentials to authenticate users securely. These credentials are created and stored by 
    authenticators (devices or software) with user consent and are restricted to the specific Relying Party 
    (the web application) that created them. This ensures privacy and security, as credentials can't be 
    accessed by other sites.
      
    There are two main steps:
    Registration – A public key credential is created and associated with a user's account.
    Authentication – The credential is used to prove the user’s identity to the Relying Party.
    
    The API is accessed via navigator.credentials.create() (for registration) and navigator.credentials.get() (for authentication), 
    and is part of the broader Credential Management API.
    
    Authenticators can be:
    Platform authenticators (built into the device),
    or Roaming authenticators (external devices using USB, NFC, or BLE).

Here are some demo videos.

Posting soon. Pardon.

How would we do the implementation?

  • The documentation for the API provides examples for doing registration and authentication.
  • We’ll need to use Kotlin/JS interop since the actual logic will be written in JavaScript. Fortunately, that is a very easy process.
  • We will call the functions inside the actual PlatformAuthentication class for the JS (I haven't yet checked how things will work in wasmJS).

Additional requirements:

  • The data received during the registration process needs to be saved. Also, we have to extract some data from the JSON response, like the credential ID and, attestation object.
  • These things are supposed to be done by the server. The server also, in turn, verifies the data sent after the registration and authentication process. But we are keeping all the things online, so we don't have to do additional verification of the data, but we still need the library to extract the data from the JSON.
Ngôn ngữ chính
Kotlin
Star
5
Fork
8
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

  • Không có Dockerfile hay tệp Docker Compose
  • Có mẫu pull request
  • Không có hướng dẫn đóng góp

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của openMF/mifos-passcode-cmp

Tất cả issue của openMF/mifos-passcode-cmp

Issue tương tự

Thêm issue về Kotlin

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.