Passkeys and MFA: WebAuthn enrollment, sign-in and replacement

import {
  generateRegistrationOptions, verifyRegistrationResponse,
  generateAuthenticationOptions, verifyAuthenticationResponse,
} from '@simplewebauthn/server';

const rp = {name: 'Example Accounts', id: 'accounts.example', origin: 'https://accounts.example'};

// Registration adds durable authority: call it only from a recently reauthenticated session.
export async function registrationOptions(session, user, existing) {
  const options = await generateRegistrationOptions({
    rpName: rp.name, rpID: rp.id, userName: user.email,
    userID: user.webauthnUserId, // random bytes stored with the account, never the email
    attestationType: 'none',
    excludeCredentials: existing.map(c => ({id: c.id, transports: c.transports})),
    authenticatorSelection: {residentKey: 'required', userVerification: 'required'},
  });
  session.challenge = options.challenge;
  return options; // for navigator.credentials.create() in the browser
}

export async function finishRegistration(session, user, response) {
  const expectedChallenge = session.challenge;
  delete session.challenge; // one use, even on failure
  const {verified, registrationInfo: info} = await verifyRegistrationResponse({
    response, expectedChallenge, expectedOrigin: rp.origin, expectedRPID: rp.id,
    requireUserVerification: true,
  });
  if (!verified) throw new Error('registration failed');
  return {
    userId: user.id, // the server-selected account, not a browser-supplied user handle
    ...info.credential, // id, publicKey, counter, transports
    backupEligible: info.credentialDeviceType === 'multiDevice', // BE flag: a synced passkey
    backedUp: info.credentialBackedUp, // BS flag
  };
}

export async function authenticationOptions(session) {
  const options = await generateAuthenticationOptions({rpID: rp.id, userVerification: 'required'});
  session.challenge = options.challenge;
  return options; // for navigator.credentials.get()
}

export async function finishAuthentication(session, response, findCredential) {
  const expectedChallenge = session.challenge;
  delete session.challenge;
  const credential = await findCredential(response.id);
  if (!expectedChallenge || !credential) throw new Error('authentication failed');
  const {verified, authenticationInfo} = await verifyAuthenticationResponse({
    response, expectedChallenge, expectedOrigin: rp.origin, expectedRPID: rp.id,
    credential, requireUserVerification: true,
  });
  if (!verified) throw new Error('authentication failed');
  credential.counter = authenticationInfo.newCounter;
  credential.backedUp = authenticationInfo.credentialBackedUp;
  return credential.userId; // now rotate the session and record the method and time
}

from webauthn import (
    generate_authentication_options, generate_registration_options, options_to_json,
    verify_authentication_response, verify_registration_response,
)
from webauthn.helpers.structs import (
    AuthenticatorSelectionCriteria, CredentialDeviceType, PublicKeyCredentialDescriptor,
    ResidentKeyRequirement, UserVerificationRequirement,
)

RP_ID, RP_NAME, ORIGIN = "accounts.example", "Example Accounts", "https://accounts.example"


# Registration adds durable authority: call it only from a recently reauthenticated session.
def registration_options(session, user, existing) -> str:
    options = generate_registration_options(
        rp_id=RP_ID, rp_name=RP_NAME, user_name=user["email"],
        user_id=user["webauthn_user_id"],  # random bytes stored with the account, never the email
        exclude_credentials=[PublicKeyCredentialDescriptor(id=c["id"]) for c in existing],
        authenticator_selection=AuthenticatorSelectionCriteria(
            resident_key=ResidentKeyRequirement.REQUIRED,
            user_verification=UserVerificationRequirement.REQUIRED,
        ),
    )  # attestation defaults to "none"
    session["challenge"] = options.challenge
    return options_to_json(options)  # for navigator.credentials.create() in the browser


def finish_registration(session, user, credential_json) -> dict:
    challenge = session.pop("challenge", None)  # one use, even on failure
    if challenge is None:
        raise ValueError("no registration in progress")
    reg = verify_registration_response(
        credential=credential_json, expected_challenge=challenge, expected_rp_id=RP_ID,
        expected_origin=ORIGIN, require_user_verification=True,
    )
    return {
        "user_id": user["id"],  # the server-selected account, not a browser-supplied user handle
        "id": reg.credential_id, "public_key": reg.credential_public_key, "sign_count": reg.sign_count,
        "backup_eligible": reg.credential_device_type == CredentialDeviceType.MULTI_DEVICE,  # BE flag
        "backed_up": reg.credential_backed_up,  # BS flag
    }


def authentication_options(session) -> str:
    options = generate_authentication_options(
        rp_id=RP_ID, user_verification=UserVerificationRequirement.REQUIRED)
    session["challenge"] = options.challenge
    return options_to_json(options)  # for navigator.credentials.get()


def finish_authentication(session, credential_json, find_credential):
    challenge = session.pop("challenge", None)
    credential = find_credential(credential_json["rawId"])
    if challenge is None or credential is None:
        raise ValueError("authentication failed")
    result = verify_authentication_response(
        credential=credential_json, expected_challenge=challenge, expected_rp_id=RP_ID,
        expected_origin=ORIGIN, credential_public_key=credential["public_key"],
        credential_current_sign_count=credential["sign_count"], require_user_verification=True,
    )
    credential["sign_count"] = result.new_sign_count
    credential["backed_up"] = result.credential_backed_up
    return credential["user_id"]  # now rotate the session and record the method and time

import java.util.Set;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.webauthn.api.AuthenticatorSelectionCriteria;
import org.springframework.security.web.webauthn.api.PublicKeyCredentialRpEntity;
import org.springframework.security.web.webauthn.api.ResidentKeyRequirement;
import org.springframework.security.web.webauthn.api.UserVerificationRequirement;
import org.springframework.security.web.webauthn.management.PublicKeyCredentialUserEntityRepository;
import org.springframework.security.web.webauthn.management.UserCredentialRepository;
import org.springframework.security.web.webauthn.management.WebAuthnRelyingPartyOperations;
import org.springframework.security.web.webauthn.management.Webauthn4JRelyingPartyOperations;

@Configuration
class PasskeyConfig {

    @Bean
    SecurityFilterChain web(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(requests -> requests.anyRequest().authenticated())
                .formLogin(Customizer.withDefaults())
                // Adds /webauthn/register/options, /webauthn/register,
                // /webauthn/authenticate/options and /login/webauthn.
                .webAuthn(webAuthn -> webAuthn.rpName("Example Accounts").rpId("accounts.example")
                        .allowedOrigins("https://accounts.example"));
        return http.build();
    }

    @Bean
    WebAuthnRelyingPartyOperations relyingParty(PublicKeyCredentialUserEntityRepository users,
            UserCredentialRepository credentials) { // JDBC implementations in production
        Webauthn4JRelyingPartyOperations rp = new Webauthn4JRelyingPartyOperations(users, credentials,
                PublicKeyCredentialRpEntity.builder().id("accounts.example").name("Example Accounts").build(),
                Set.of("https://accounts.example"));
        // Spring's default is userVerification "preferred", which accepts a response without
        // the UV flag. Require it, for registration and for sign-in.
        rp.setCustomizeCreationOptions(options -> options.authenticatorSelection(
                AuthenticatorSelectionCriteria.builder()
                        .residentKey(ResidentKeyRequirement.REQUIRED)
                        .userVerification(UserVerificationRequirement.REQUIRED)
                        .build()));
        rp.setCustomizeRequestOptions(options -> options.userVerification(UserVerificationRequirement.REQUIRED));
        return rp;
    }
}