AshAuthentication.Strategy.WebAuthn.Plug (ash_authentication v5.0.0-rc.11)

Plug handlers for the WebAuthn strategy.

Handles registration challenges, registration, authentication challenges, and authentication via HTTP requests. Challenges are stored in the Plug session.

Summary

Functions

add_credential(conn, strategy)

Handle an add_credential request — attach a new credential to the authenticated user.

add_credential_challenge(conn, strategy)

Generate and return a registration challenge for adding a credential to the current user.

authentication_challenge(conn, strategy)

Generate and return an authentication challenge.

register(conn, strategy)

Handle a registration request.

registration_challenge(conn, strategy)

Generate and return a registration challenge.

sign_in(conn, strategy)

Handle an authentication request.

sign_in_with_token(conn, strategy)

Exchange a short-lived sign-in token for an authenticated session.

verify(conn, strategy)

Handle a second-factor verify request — confirm that the assertion was signed by one of the authenticated actor's credentials. On success the actor's :webauthn_verified_at metadata is stamped and a fresh token carrying the same value as a JWT claim is issued.

verify_challenge(conn, strategy)

Generate and return a verification (second-factor) challenge.

Functions

add_credential(conn, strategy)

@spec add_credential(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Handle an add_credential request — attach a new credential to the authenticated user.

Requires an authenticated actor on the connection.

add_credential_challenge(conn, strategy)

@spec add_credential_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a registration challenge for adding a credential to the current user.

Requires an authenticated actor on the connection.

authentication_challenge(conn, strategy)

@spec authentication_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return an authentication challenge.

register(conn, strategy)

@spec register(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Handle a registration request.

registration_challenge(conn, strategy)

@spec registration_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a registration challenge.

sign_in(conn, strategy)

@spec sign_in(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) :: Plug.Conn.t()

Handle an authentication request.

sign_in_with_token(conn, strategy)

@spec sign_in_with_token(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Exchange a short-lived sign-in token for an authenticated session.

verify(conn, strategy)

@spec verify(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) :: Plug.Conn.t()

Handle a second-factor verify request — confirm that the assertion was signed by one of the authenticated actor's credentials. On success the actor's :webauthn_verified_at metadata is stamped and a fresh token carrying the same value as a JWT claim is issued.

verify_challenge(conn, strategy)

@spec verify_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a verification (second-factor) challenge.

Requires an authenticated actor on the connection. The actor's existing credentials are listed as allow_credentials so the browser only offers those.