Web Authentication for Laravel

WebAuthn for Laravel is a package for authenticating users without passwords using their device, fingerprint, or other biometric data.

This package validates the WebAuthn payload from devices using a custom user provider to authenticate users in Laravel:

<?php

namespace App;

use Illuminate\Foundation\Auth\User as Authenticatable;
use DarkGhostHunter\Larapass\Contracts\WebAuthnAuthenticatable;
use DarkGhostHunter\Larapass\WebAuthnAuthentication;

class User extends Authenticatable implements WebAuthnAuthenticatable
{
    use WebAuthnAuthentication;

    // ...
}

To tie this package together on the frontend, it provides an optional JavaScript helper for handling registration and login via the WebAuthn W3 standard:

<script src="{{ asset('vendor/larapass/js/larapass.js') }}"></script>

<!-- Registering users -->
<script>
    const register = () => {
        new Larapass({
            register: 'webauthn/register',
            registerOptions: 'webauthn/register/options'
        }).register()
          .then(response => window.location.href = 'https://myapp.com/devices')
          .catch(response => alert('Something went wrong, try again!'))
    }

    document.getElementById('register-form').addEventListener('submit', register)
</script>

<!-- Login users -->
<script>
    const login = () => {
        new Larapass({
            login: 'webauthn/register',
            loginOptions: 'webauthn/register/options'
        }).login({
            email: document.getElementById('email').value,
        }).then(response => window.location.href = 'https://myapp.com/account')
          .catch(error => alert('Something went wrong, try again!'))
    }

    document.getElementById('login-form').addEventListener('submit', login)
</script>

The Web Authentication API (WebAuthn) is a password-less web browser standard adopted (in various degrees) by Firefox, Chrome, Edge, and other modern browsers (see caniuse data). An excellent introduction to understanding Web Authentication is this Guide to Web Authentication.

#Learn More

I’d strongly recommend getting familiar with WebAuthn and evaluating browser support before implementing it in your application. You could support WebAuthn is a progressive way, only allowing it if a user’s browser is capable.

You can learn more about this package, get full installation instructions, and view the source code on GitHub at DarkGhostHunter/Larapass.