WebAuthn
A W3C standard browser API for public-key authentication. WebAuthn is the protocol used by passkeys and FIDO2 security keys. The relying party server stores the public key, the authenticator holds the private key.
WebAuthn is the API every passkey and security key goes through, and the parameters a relying party sets decide the security you actually get: userVerification determines whether a PIN or biometric is required, attestation determines whether you can tell what kind of authenticator enrolled, and the RP ID fixes the origin the credential will sign for. Validate the user-verification flag server side rather than trusting the client.
See also: WebAuthn and FIDO2, passkey, relying party, add passkeys with WebAuthn recipe
Related on Start with Identity
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- GlossaryNIST SP 800-63
The US National Institute of Standards and Technology Digital Identity Guidelines. Defines Identity Assurance Levels (IAL), Authenticator Assurance Levels (AAL)
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- BlogPass-the-Passkey: a Black Hat researcher found the WebAuthn implementation bugs, not the standard
At Black Hat USA 2026, DSInternals researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures readable by any au