AshAuthentication.Strategy.WebAuthn.Plug (ash_authentication v5.0.0-rc.8)

Copy Markdown View Source

Plug handlers for the WebAuthn strategy.

Handles registration challenges, registration, authentication challenges, and authentication via HTTP requests. Challenges are stored in the Plug session.

Summary

Functions

add_credential(conn, strategy)

Handle an add_credential request — attach a new credential to the authenticated user.

add_credential_challenge(conn, strategy)

Generate and return a registration challenge for adding a credential to the current user.

authentication_challenge(conn, strategy)

Generate and return an authentication challenge.

register(conn, strategy)

Handle a registration request.

registration_challenge(conn, strategy)

Generate and return a registration challenge.

sign_in(conn, strategy)

Handle an authentication request.

sign_in_with_token(conn, strategy)

Exchange a short-lived sign-in token for an authenticated session.

verify(conn, strategy)

Handle a second-factor verify request — confirm that the assertion was signed by one of the authenticated actor's credentials. On success the actor's :webauthn_verified_at metadata is stamped and a fresh token carrying the same value as a JWT claim is issued.

verify_challenge(conn, strategy)

Generate and return a verification (second-factor) challenge.

Functions

add_credential(conn, strategy)

@spec add_credential(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Handle an add_credential request — attach a new credential to the authenticated user.

Requires an authenticated actor on the connection.

add_credential_challenge(conn, strategy)

@spec add_credential_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a registration challenge for adding a credential to the current user.

Requires an authenticated actor on the connection.

authentication_challenge(conn, strategy)

@spec authentication_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return an authentication challenge.

register(conn, strategy)

@spec register(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Handle a registration request.

registration_challenge(conn, strategy)

@spec registration_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a registration challenge.

sign_in(conn, strategy)

@spec sign_in(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) :: Plug.Conn.t()

Handle an authentication request.

sign_in_with_token(conn, strategy)

@spec sign_in_with_token(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Exchange a short-lived sign-in token for an authenticated session.

verify(conn, strategy)

@spec verify(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) :: Plug.Conn.t()

Handle a second-factor verify request — confirm that the assertion was signed by one of the authenticated actor's credentials. On success the actor's :webauthn_verified_at metadata is stamped and a fresh token carrying the same value as a JWT claim is issued.

verify_challenge(conn, strategy)

@spec verify_challenge(Plug.Conn.t(), AshAuthentication.Strategy.WebAuthn.t()) ::
  Plug.Conn.t()

Generate and return a verification (second-factor) challenge.

Requires an authenticated actor on the connection. The actor's existing credentials are listed as allow_credentials so the browser only offers those.