Production Passkey Implementation: WebAuthn/FIDO2 Security Analysis and Complete Code

# Node.js backend
npm install @simplewebauthn/[email protected] @simplewebauthn/[email protected] [email protected]

# Python backend alternative
pip install py-webauthn==2.0.0 flask==3.0.0 cryptography==41.0.0

# Development server
npm install -D @types/[email protected] [email protected]

/**
 * Production WebAuthn server with passkey registration and authentication.
 */

const express = require('express');
const session = require('express-session');
const {
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
} = require('@simplewebauthn/server');
const crypto = require('crypto');

const app = express();
app.use(express.json());
app.use(express.static('public'));

// Session configuration (use Redis in production)
app.use(session({
  secret: process.env.SESSION_SECRET || crypto.randomBytes(32).toString('hex'),
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production', // HTTPS only in prod
    sameSite: 'lax',
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
}));

// Configuration
const rpName = 'Example Corp';
const rpID = process.env.RP_ID || 'localhost';
const origin = process.env.ORIGIN || `https://${rpID}`;

// In-memory storage (use database in production)
const users = new Map(); // userId -> { username, credentials: [] }
const challenges = new Map(); // userId -> challenge

/**
 * Generate unique user ID.
 */
function generateUserId() {
  return crypto.randomBytes(16).toString('base64url');
}

/**
 * POST /register/start - Begin passkey registration
 */
app.post('/register/start', async (req, res) => {
  try {
    const { username } = req.body;

    if (!username || username.length < 3) {
      return res.status(400).json({ error: 'Username must be at least 3 characters' });
    }

    // Check if user already exists
    let user = Array.from(users.values()).find(u => u.username === username);

    if (!user) {
      // Create new user
      const userId = generateUserId();
      user = {
        id: userId,
        username,
        credentials: []
      };
      users.set(userId, user);
    }

    // Generate registration options
    const options = await generateRegistrationOptions({
      rpName,
      rpID,
      userID: user.id,
      userName: user.username,
      userDisplayName: user.username,
      // Attestation preference (none = no attestation, direct = get authenticator info)
      attestationType: 'none',
      // Exclude already registered authenticators
      excludeCredentials: user.credentials.map(cred => ({
        id: Buffer.from(cred.credentialID, 'base64url'),
        type: 'public-key',
        transports: cred.transports,
      })),
      // Authenticator selection criteria
      authenticatorSelection: {
        residentKey: 'preferred', // Prefer discoverable credentials
        userVerification: 'preferred', // Prefer biometric/PIN
        authenticatorAttachment: 'platform', // Prefer platform authenticators (Touch ID, Windows Hello)
      },
    });

    // Store challenge temporarily
    challenges.set(user.id, options.challenge);

    // Store user ID in session
    req.session.userId = user.id;

    res.json(options);
  } catch (error) {
    console.error('Registration start error:', error);
    res.status(500).json({ error: 'Registration failed' });
  }
});

/**
 * POST /register/finish - Complete passkey registration
 */
app.post('/register/finish', async (req, res) => {
  try {
    const { userId } = req.session;

    if (!userId) {
      return res.status(401).json({ error: 'No active registration session' });
    }

    const user = users.get(userId);
    const expectedChallenge = challenges.get(userId);

    if (!user || !expectedChallenge) {
      return res.status(400).json({ error: 'Invalid session' });
    }

    // Verify registration response
    const verification = await verifyRegistrationResponse({
      response: req.body,
      expectedChallenge,
      expectedOrigin: origin,
      expectedRPID: rpID,
      requireUserVerification: true,
    });

    const { verified, registrationInfo } = verification;

    if (!verified || !registrationInfo) {
      return res.status(400).json({ error: 'Verification failed' });
    }

    const {
      credentialPublicKey,
      credentialID,
      counter,
      credentialBackedUp,
      credentialDeviceType,
    } = registrationInfo;

    // Store credential
    const newCredential = {
      credentialID: Buffer.from(credentialID).toString('base64url'),
      credentialPublicKey: Buffer.from(credentialPublicKey).toString('base64url'),
      counter,
      transports: req.body.response.transports || [],
      backedUp: credentialBackedUp,
      deviceType: credentialDeviceType,
      createdAt: new Date().toISOString(),
    };

    user.credentials.push(newCredential);

    // Clean up challenge
    challenges.delete(userId);

    console.log(`✓ Registered passkey for ${user.username}`);
    console.log(`  Device type: ${credentialDeviceType}`);
    console.log(`  Backed up: ${credentialBackedUp}`);

    res.json({ verified: true, username: user.username });
  } catch (error) {
    console.error('Registration finish error:', error);
    res.status(500).json({ error: 'Registration verification failed' });
  }
});

/**
 * POST /login/start - Begin passkey authentication
 */
app.post('/login/start', async (req, res) => {
  try {
    const { username } = req.body;

    // Find user (empty username = discoverable credential flow)
    let user = null;
    let allowCredentials = [];

    if (username) {
      user = Array.from(users.values()).find(u => u.username === username);

      if (!user || user.credentials.length === 0) {
        return res.status(404).json({ error: 'User not found or no passkeys registered' });
      }

      // Specify which credentials are allowed
      allowCredentials = user.credentials.map(cred => ({
        id: Buffer.from(cred.credentialID, 'base64url'),
        type: 'public-key',
        transports: cred.transports,
      }));
    }

    // Generate authentication options
    const options = await generateAuthenticationOptions({
      rpID,
      userVerification: 'preferred',
      allowCredentials: allowCredentials.length > 0 ? allowCredentials : undefined,
    });

    // Store challenge and user ID
    if (user) {
      challenges.set(user.id, options.challenge);
      req.session.userId = user.id;
    } else {
      // For discoverable credentials, store challenge globally
      req.session.authChallenge = options.challenge;
    }

    res.json(options);
  } catch (error) {
    console.error('Login start error:', error);
    res.status(500).json({ error: 'Authentication failed' });
  }
});

/**
 * POST /login/finish - Complete passkey authentication
 */
app.post('/login/finish', async (req, res) => {
  try {
    const { userId, authChallenge } = req.session;
    const { response } = req.body;

    // Find user by credential ID
    const credentialID = Buffer.from(response.id, 'base64url');
    let user = null;
    let credential = null;

    for (const [uid, userData] of users.entries()) {
      const cred = userData.credentials.find(
        c => Buffer.from(c.credentialID, 'base64url').equals(credentialID)
      );
      if (cred) {
        user = userData;
        credential = cred;
        break;
      }
    }

    if (!user || !credential) {
      return res.status(404).json({ error: 'Credential not found' });
    }

    const expectedChallenge = challenges.get(user.id) || authChallenge;

    if (!expectedChallenge) {
      return res.status(400).json({ error: 'No challenge found' });
    }

    // Verify authentication response
    const verification = await verifyAuthenticationResponse({
      response: req.body,
      expectedChallenge,
      expectedOrigin: origin,
      expectedRPID: rpID,
      authenticator: {
        credentialPublicKey: Buffer.from(credential.credentialPublicKey, 'base64url'),
        credentialID: Buffer.from(credential.credentialID, 'base64url'),
        counter: credential.counter,
      },
      requireUserVerification: true,
    });

    const { verified, authenticationInfo } = verification;

    if (!verified) {
      return res.status(401).json({ error: 'Authentication failed' });
    }

    // Update counter (prevents replay attacks)
    credential.counter = authenticationInfo.newCounter;
    credential.lastUsed = new Date().toISOString();

    // Create session
    req.session.userId = user.id;
    req.session.username = user.username;
    req.session.authenticated = true;

    // Clean up challenge
    challenges.delete(user.id);
    delete req.session.authChallenge;

    console.log(`✓ Authenticated ${user.username}`);

    res.json({
      verified: true,
      username: user.username,
      userId: user.id,
    });
  } catch (error) {
    console.error('Login finish error:', error);
    res.status(500).json({ error: 'Authentication verification failed' });
  }
});

/**
 * GET /user/info - Get current user info
 */
app.get('/user/info', (req, res) => {
  if (!req.session.authenticated) {
    return res.status(401).json({ error: 'Not authenticated' });
  }

  const user = users.get(req.session.userId);
  if (!user) {
    return res.status(404).json({ error: 'User not found' });
  }

  res.json({
    username: user.username,
    credentials: user.credentials.map(c => ({
      id: c.credentialID.slice(0, 16) + '...',
      deviceType: c.deviceType,
      backedUp: c.backedUp,
      createdAt: c.createdAt,
      lastUsed: c.lastUsed || 'Never',
    })),
  });
});

/**
 * POST /logout - Destroy session
 */
app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      return res.status(500).json({ error: 'Logout failed' });
    }
    res.json({ success: true });
  });
});

// Start server
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`\n🔐 WebAuthn Server running on https://${rpID}:${PORT}`);
  console.log(`   RP ID: ${rpID}`);
  console.log(`   Origin: ${origin}\n`);
});

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Passkey Authentication Demo</title>
  <style>
    body {
      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
      max-width: 600px;
      margin: 50px auto;
      padding: 20px;
      background: #f5f5f5;
    }
    .card {
      background: white;
      padding: 30px;
      border-radius: 8px;
      box-shadow: 0 2px 4px rgba(0,0,0,0.1);
      margin-bottom: 20px;
    }
    h1 { margin-top: 0; }
    input {
      width: 100%;
      padding: 12px;
      margin: 10px 0;
      border: 1px solid #ddd;
      border-radius: 4px;
      box-sizing: border-box;
    }
    button {
      width: 100%;
      padding: 12px;
      margin: 10px 0;
      border: none;
      border-radius: 4px;
      background: #007bff;
      color: white;
      font-size: 16px;
      cursor: pointer;
    }
    button:hover { background: #0056b3; }
    button:disabled { background: #ccc; cursor: not-allowed; }
    .success { color: #28a745; }
    .error { color: #dc3545; }
    .info { color: #17a2b8; }
    #status { margin-top: 15px; padding: 10px; border-radius: 4px; }
    .hidden { display: none; }
    .credential-list {
      list-style: none;
      padding: 0;
    }
    .credential-item {
      padding: 10px;
      background: #f8f9fa;
      margin: 5px 0;
      border-radius: 4px;
      font-size: 14px;
    }
  </style>
</head>
<body>
  <div class="card">
    <h1>🔐 Passkey Authentication</h1>
    <p>Passwordless login using WebAuthn/FIDO2</p>
  </div>

  <!-- Registration Section -->
  <div class="card" id="register-card">
    <h2>Create Passkey</h2>
    <input type="text" id="register-username" placeholder="Username" autocomplete="username webauthn">
    <button onclick="registerPasskey()">Create Passkey</button>
    <div id="register-status"></div>
  </div>

  <!-- Login Section -->
  <div class="card" id="login-card">
    <h2>Sign In with Passkey</h2>
    <input type="text" id="login-username" placeholder="Username (optional)" autocomplete="username webauthn">
    <button onclick="loginWithPasskey()">Sign In</button>
    <button onclick="loginDiscoverable()" style="background: #6c757d;">
      Sign In (Any Passkey)
    </button>
    <div id="login-status"></div>
  </div>

  <!-- User Info Section (hidden until logged in) -->
  <div class="card hidden" id="user-card">
    <h2>Welcome, <span id="username"></span>!</h2>
    <h3>Your Passkeys:</h3>
    <ul id="credentials-list" class="credential-list"></ul>
    <button onclick="logout()" style="background: #dc3545;">Logout</button>
  </div>

  <script src="https://unpkg.com/@simplewebauthn/[email protected]/dist/bundle/index.umd.min.js"></script>
  <script>
    const { startRegistration, startAuthentication } = SimpleWebAuthnBrowser;

    /**
     * Register a new passkey
     */
    async function registerPasskey() {
      const username = document.getElementById('register-username').value.trim();
      const statusEl = document.getElementById('register-status');

      if (!username) {
        showStatus(statusEl, 'Please enter a username', 'error');
        return;
      }

      try {
        showStatus(statusEl, 'Requesting registration options...', 'info');

        // Get registration options from server
        const optionsResp = await fetch('/register/start', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ username }),
        });

        if (!optionsResp.ok) {
          const error = await optionsResp.json();
          throw new Error(error.error || 'Registration failed');
        }

        const options = await optionsResp.json();

        showStatus(statusEl, 'Please use your biometric...', 'info');

        // Call WebAuthn API
        const registrationResponse = await startRegistration(options);

        showStatus(statusEl, 'Verifying...', 'info');

        // Send response to server for verification
        const verificationResp = await fetch('/register/finish', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify(registrationResponse),
        });

        const verificationResult = await verificationResp.json();

        if (verificationResult.verified) {
          showStatus(statusEl, `✓ Passkey created for ${username}!`, 'success');
          document.getElementById('register-username').value = '';
        } else {
          throw new Error('Verification failed');
        }
      } catch (error) {
        console.error('Registration error:', error);
        showStatus(statusEl, `✗ ${error.message}`, 'error');
      }
    }

    /**
     * Login with passkey (username provided)
     */
    async function loginWithPasskey() {
      const username = document.getElementById('login-username').value.trim();
      const statusEl = document.getElementById('login-status');

      if (!username) {
        showStatus(statusEl, 'Please enter a username', 'error');
        return;
      }

      await authenticate(username, statusEl);
    }

    /**
     * Login with discoverable credential (no username)
     */
    async function loginDiscoverable() {
      const statusEl = document.getElementById('login-status');
      await authenticate(null, statusEl);
    }

    /**
     * Authenticate user with passkey
     */
    async function authenticate(username, statusEl) {
      try {
        showStatus(statusEl, 'Requesting authentication options...', 'info');

        // Get authentication options from server
        const optionsResp = await fetch('/login/start', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ username: username || '' }),
        });

        if (!optionsResp.ok) {
          const error = await optionsResp.json();
          throw new Error(error.error || 'Authentication failed');
        }

        const options = await optionsResp.json();

        showStatus(statusEl, 'Please use your biometric...', 'info');

        // Call WebAuthn API
        const authResponse = await startAuthentication(options);

        showStatus(statusEl, 'Verifying...', 'info');

        // Send response to server for verification
        const verificationResp = await fetch('/login/finish', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify(authResponse),
        });

        const result = await verificationResp.json();

        if (result.verified) {
          showStatus(statusEl, `✓ Authenticated as ${result.username}!`, 'success');
          showUserInfo();
        } else {
          throw new Error('Verification failed');
        }
      } catch (error) {
        console.error('Authentication error:', error);
        showStatus(statusEl, `✗ ${error.message}`, 'error');
      }
    }

    /**
     * Show user info after login
     */
    async function showUserInfo() {
      try {
        const resp = await fetch('/user/info');
        const data = await resp.json();

        document.getElementById('username').textContent = data.username;

        const credList = document.getElementById('credentials-list');
        credList.innerHTML = '';

        data.credentials.forEach(cred => {
          const li = document.createElement('li');
          li.className = 'credential-item';
          li.innerHTML = `
            <strong>${cred.deviceType}</strong>
            (${cred.backedUp ? 'Synced ☁️' : 'Device-bound 📱'})<br>
            <small>Created: ${new Date(cred.createdAt).toLocaleDateString()}</small><br>
            <small>Last used: ${cred.lastUsed !== 'Never' ? new Date(cred.lastUsed).toLocaleDateString() : 'Never'}</small>
          `;
          credList.appendChild(li);
        });

        document.getElementById('register-card').classList.add('hidden');
        document.getElementById('login-card').classList.add('hidden');
        document.getElementById('user-card').classList.remove('hidden');
      } catch (error) {
        console.error('Failed to fetch user info:', error);
      }
    }

    /**
     * Logout
     */
    async function logout() {
      await fetch('/logout', { method: 'POST' });

      document.getElementById('register-card').classList.remove('hidden');
      document.getElementById('login-card').classList.remove('hidden');
      document.getElementById('user-card').classList.add('hidden');

      document.getElementById('login-username').value = '';
    }

    /**
     * Show status message
     */
    function showStatus(element, message, type) {
      element.textContent = message;
      element.className = type;
    }

    // Check if already authenticated on page load
    fetch('/user/info')
      .then(resp => resp.ok ? showUserInfo() : null)
      .catch(() => {});
  </script>
</body>
</html>

"""
Production WebAuthn server with passkey registration and authentication (Python/Flask).
"""

from flask import Flask, request, session, jsonify, send_from_directory
from webauthn import (
    generate_registration_options,
    verify_registration_response,
    generate_authentication_options,
    verify_authentication_response,
    options_to_json,
)
from webauthn.helpers.structs import (
    AuthenticatorSelectionCriteria,
    UserVerificationRequirement,
    AuthenticatorAttachment,
    ResidentKeyRequirement,
    PublicKeyCredentialDescriptor,
)
from webauthn.helpers.cose import COSEAlgorithmIdentifier
import secrets
import os
from datetime import timedelta

app = Flask(__name__)
app.secret_key = os.environ.get('SECRET_KEY', secrets.token_hex(32))
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
app.config['SESSION_COOKIE_SECURE'] = os.environ.get('FLASK_ENV') == 'production'
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=1)

# Configuration
RP_NAME = "Example Corp"
RP_ID = os.environ.get('RP_ID', 'localhost')
ORIGIN = os.environ.get('ORIGIN', f'https://{RP_ID}')

# In-memory storage (use database in production)
users = {}  # user_id -> { username, credentials: [] }
challenges = {}  # user_id -> challenge

def generate_user_id():
    """Generate unique user ID."""
    return secrets.token_urlsafe(16)

@app.route('/register/start', methods=['POST'])
def register_start():
    """Begin passkey registration."""
    try:
        data = request.get_json()
        username = data.get('username', '').strip()

        if not username or len(username) < 3:
            return jsonify({'error': 'Username must be at least 3 characters'}), 400

        # Find or create user
        user = next((u for u in users.values() if u['username'] == username), None)

        if not user:
            user_id = generate_user_id()
            user = {
                'id': user_id,
                'username': username,
                'credentials': []
            }
            users[user_id] = user

        # Exclude already registered credentials
        exclude_credentials = [
            PublicKeyCredentialDescriptor(id=bytes.fromhex(cred['credential_id']))
            for cred in user['credentials']
        ]

        # Generate registration options
        options = generate_registration_options(
            rp_id=RP_ID,
            rp_name=RP_NAME,
            user_id=user['id'].encode('utf-8'),
            user_name=user['username'],
            exclude_credentials=exclude_credentials if exclude_credentials else None,
            authenticator_selection=AuthenticatorSelectionCriteria(
                authenticator_attachment=AuthenticatorAttachment.PLATFORM,
                resident_key=ResidentKeyRequirement.PREFERRED,
                user_verification=UserVerificationRequirement.PREFERRED,
            ),
            supported_pub_key_algs=[
                COSEAlgorithmIdentifier.ECDSA_SHA_256,
                COSEAlgorithmIdentifier.RSASSA_PKCS1_v1_5_SHA_256,
            ],
        )

        # Store challenge
        challenges[user['id']] = options.challenge
        session['user_id'] = user['id']

        return jsonify(options_to_json(options))
    except Exception as e:
        print(f"Registration start error: {e}")
        return jsonify({'error': 'Registration failed'}), 500

@app.route('/register/finish', methods=['POST'])
def register_finish():
    """Complete passkey registration."""
    try:
        user_id = session.get('user_id')
        if not user_id:
            return jsonify({'error': 'No active registration session'}), 401

        user = users.get(user_id)
        expected_challenge = challenges.get(user_id)

        if not user or not expected_challenge:
            return jsonify({'error': 'Invalid session'}), 400

        # Verify registration response
        credential = verify_registration_response(
            credential=request.get_json(),
            expected_challenge=expected_challenge,
            expected_origin=ORIGIN,
            expected_rp_id=RP_ID,
            require_user_verification=True,
        )

        # Store credential
        new_credential = {
            'credential_id': credential.credential_id.hex(),
            'credential_public_key': credential.credential_public_key.hex(),
            'sign_count': credential.sign_count,
            'backed_up': credential.credential_backed_up,
            'device_type': credential.credential_device_type,
            'transports': getattr(credential, 'transports', []),
            'created_at': str(datetime.now()),
        }

        user['credentials'].append(new_credential)

        # Clean up challenge
        del challenges[user_id]

        print(f"✓ Registered passkey for {user['username']}")
        print(f"  Device type: {new_credential['device_type']}")
        print(f"  Backed up: {new_credential['backed_up']}")

        return jsonify({'verified': True, 'username': user['username']})
    except Exception as e:
        print(f"Registration finish error: {e}")
        return jsonify({'error': 'Registration verification failed'}), 500

@app.route('/login/start', methods=['POST'])
def login_start():
    """Begin passkey authentication."""
    try:
        data = request.get_json()
        username = data.get('username', '').strip()

        user = None
        allow_credentials = []

        if username:
            user = next((u for u in users.values() if u['username'] == username), None)

            if not user or not user['credentials']:
                return jsonify({'error': 'User not found or no passkeys registered'}), 404

            allow_credentials = [
                PublicKeyCredentialDescriptor(id=bytes.fromhex(cred['credential_id']))
                for cred in user['credentials']
            ]

        # Generate authentication options
        options = generate_authentication_options(
            rp_id=RP_ID,
            allow_credentials=allow_credentials if allow_credentials else None,
            user_verification=UserVerificationRequirement.PREFERRED,
        )

        if user:
            challenges[user['id']] = options.challenge
            session['user_id'] = user['id']
        else:
            session['auth_challenge'] = options.challenge.hex()

        return jsonify(options_to_json(options))
    except Exception as e:
        print(f"Login start error: {e}")
        return jsonify({'error': 'Authentication failed'}), 500

@app.route('/login/finish', methods=['POST'])
def login_finish():
    """Complete passkey authentication."""
    try:
        auth_response = request.get_json()
        credential_id = bytes.fromhex(auth_response['id'])

        # Find user by credential ID
        user = None
        credential = None

        for u in users.values():
            for cred in u['credentials']:
                if bytes.fromhex(cred['credential_id']) == credential_id:
                    user = u
                    credential = cred
                    break
            if user:
                break

        if not user or not credential:
            return jsonify({'error': 'Credential not found'}), 404

        expected_challenge = challenges.get(user['id'])
        if not expected_challenge:
            expected_challenge = bytes.fromhex(session.get('auth_challenge', ''))

        if not expected_challenge:
            return jsonify({'error': 'No challenge found'}), 400

        # Verify authentication response
        verification = verify_authentication_response(
            credential=auth_response,
            expected_challenge=expected_challenge,
            expected_origin=ORIGIN,
            expected_rp_id=RP_ID,
            credential_public_key=bytes.fromhex(credential['credential_public_key']),
            credential_current_sign_count=credential['sign_count'],
            require_user_verification=True,
        )

        # Update sign count
        credential['sign_count'] = verification.new_sign_count
        credential['last_used'] = str(datetime.now())

        # Create session
        session['user_id'] = user['id']
        session['username'] = user['username']
        session['authenticated'] = True

        # Clean up challenges
        if user['id'] in challenges:
            del challenges[user['id']]
        session.pop('auth_challenge', None)

        print(f"✓ Authenticated {user['username']}")

        return jsonify({
            'verified': True,
            'username': user['username'],
            'userId': user['id'],
        })
    except Exception as e:
        print(f"Login finish error: {e}")
        return jsonify({'error': 'Authentication verification failed'}), 500

@app.route('/user/info')
def user_info():
    """Get current user info."""
    if not session.get('authenticated'):
        return jsonify({'error': 'Not authenticated'}), 401

    user = users.get(session.get('user_id'))
    if not user:
        return jsonify({'error': 'User not found'}), 404

    return jsonify({
        'username': user['username'],
        'credentials': [
            {
                'id': cred['credential_id'][:16] + '...',
                'deviceType': cred['device_type'],
                'backedUp': cred['backed_up'],
                'createdAt': cred['created_at'],
                'lastUsed': cred.get('last_used', 'Never'),
            }
            for cred in user['credentials']
        ],
    })

@app.route('/logout', methods=['POST'])
def logout():
    """Destroy session."""
    session.clear()
    return jsonify({'success': True})

@app.route('/')
def index():
    """Serve index.html."""
    return send_from_directory('public', 'index.html')

@app.route('/<path:path>')
def static_files(path):
    """Serve static files."""
    return send_from_directory('public', path)

if __name__ == '__main__':
    print(f"\n🔐 WebAuthn Server running on {ORIGIN}")
    print(f"   RP ID: {RP_ID}\n")

    # HTTPS required for WebAuthn (except localhost)
    if RP_ID == 'localhost':
        app.run(debug=True, port=3000)
    else:
        # Use production HTTPS server
        app.run(host='0.0.0.0', port=443, ssl_context='adhoc')

// Allow backup authentication methods during transition
const backupMethods = {
  EMAIL_CODE: 'Send code to registered email',
  RECOVERY_CODE: 'One-time recovery codes (like 2FA backup)',
  SUPPORT: 'Manual verification by support team',
};

// Store recovery codes during passkey setup
app.post('/recovery/generate', requireAuth, (req, res) => {
  const recoveryCodes = Array.from({ length: 10 }, () =>
    crypto.randomBytes(4).toString('hex').toUpperCase()
  );

  // Hash before storing
  const hashedCodes = recoveryCodes.map(code =>
    crypto.createHash('sha256').update(code).digest('hex')
  );

  users.get(req.session.userId).recoveryCodes = hashedCodes;

  res.json({ codes: recoveryCodes }); // Show once, user must save
});

// Feature detection
async function checkPasskeySupport() {
  if (!window.PublicKeyCredential) {
    showMessage('Passkeys not supported. Please update your browser.');
    return false;
  }

  // Check for conditional mediation (discoverable credentials)
  const available = await PublicKeyCredential.isConditionalMediationAvailable();
  if (!available) {
    console.warn('Conditional mediation not available');
  }

  return true;
}

// Fallback to password + TOTP for unsupported browsers
if (!await checkPasskeySupport()) {
  showPasswordLoginForm();
}

// Log passkey operations for security monitoring
function logPasskeyEvent(event, userId, metadata = {}) {
  console.log(JSON.stringify({
    timestamp: new Date().toISOString(),
    event,
    userId,
    ip: req.ip,
    userAgent: req.get('User-Agent'),
    ...metadata,
  }));
}

// Example usage
logPasskeyEvent('PASSKEY_REGISTERED', user.id, {
  deviceType: credential.deviceType,
  backedUp: credential.backedUp,
});

logPasskeyEvent('AUTH_SUCCESS', user.id, {
  credentialId: credential.id.slice(0, 16),
});

const rateLimit = require('express-rate-limit');

// Prevent brute force on passkey operations
const passkeyLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 10, // 10 attempts per window
  message: 'Too many passkey attempts, please try again later',
  standardHeaders: true,
  legacyHeaders: false,
});

app.use('/register/*', passkeyLimiter);
app.use('/login/*', passkeyLimiter);