java-webauthn-server

java-webauthn-server
====================
:toc:
:toc-placement: macro
:toc-title:
:idprefix:
:idseparator: -

image:https://github.com/Yubico/java-webauthn-server/actions/workflows/build.yml/badge.svg?branch=main["Build Status", link="https://github.com/Yubico/java-webauthn-server/actions/workflows/build.yml?query=branch%3Amain"]
image:https://img.shields.io/endpoint?url=https%3A%2F%2FYubico.github.io%2Fjava-webauthn-server%2Fcoverage-badge.json["Mutation test coverage", link="https://Yubico.github.io/java-webauthn-server/"]
image:https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml/badge.svg["Binary reproducibility", link="https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml"]

Server-side https://www.w3.org/TR/webauthn/[Web Authentication] library for
Java. Provides implementations of the
https://www.w3.org/TR/webauthn/#sctn-rp-operations[Relying Party operations] required
for a server to support Web Authentication, including https://passkeys.dev/[passkey authentication].


[WARNING]
.*Psychic signatures in Java*
==========
In April 2022, link:https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/[CVE-2022-21449]
was disclosed in Oracle's OpenJDK (and other JVMs derived from it) which can impact applications using java-webauthn-server.
The impact is that for the most common type of WebAuthn credential, invalid signatures are accepted as valid,
allowing authentication bypass for users with such a credential.
Please read link:https://openjdk.java.net/groups/vulnerability/advisories/2022-04-19[Oracle's advisory]
and make sure you are not using one of the impacted OpenJDK versions.
If you are, we urge you to upgrade your Java deployment to a version that is safe.
==========


*Table of contents*

:toclevels: 3
toc::[]


== Features

- Generates request objects suitable as parameters to
  `navigator.credentials.create()` and `.get()`
- Performs all necessary
  https://www.w3.org/TR/webauthn/#sctn-rp-operations[validation logic] on the
  response from the client
- No mutable state or side effects - everything (except builders) is thread safe
- Optionally integrates with an "attestation trust source" to verify
  https://www.w3.org/TR/webauthn/#sctn-attestation[authenticator attestations]
- Reproducible builds: release signatures match fresh builds from source. See
  <<reproducible-builds>> below.


=== Non-features

This library has no concept of accounts, sessions, permissions or identity
federation, and it is not an authentication framework; it only deals with
executing the WebAuthn authentication mechanism. Sessions, account management
and other higher level concepts can make use of this authentication mechanism,
but the authentication mechanism alone does not make a security system.


== Dependency configuration

Maven:

----------
<dependency>
  <groupId>com.yubico</groupId>
  <artifactId>webauthn-server-core</artifactId>
  <version>2.10.1</version>
  <sco