webauthn-rs

A framework-agnostic WebAuthn/Passkeys server implementation for Rust.

This library provides the core logic and types for implementing WebAuthn (Level 3) and FIDO2 (CTAP2) server-side verification in Rust applications. It is designed to be highly flexible, secure, and easy to integrate into any web framework.

🚀 Key Features

• Framework Agnostic: Core logic is independent of any specific web framework.
• Framework Integrations: Ready-to-use integrations for Axum and Actix-web (via feature flags).
• FIDO2 Metadata Service (MDS): Integration with the FIDO Alliance MDS for authenticator verification and security property checks.
• Comprehensive Attestation Support: Supports all major attestation formats:
  • none, packed, tpm, android-key, android-safetynet, apple, and fido-u2f.
• Advanced Extensions: Support for prf (HMAC Secret), largeBlob, appid (U2F backward compatibility), and more.
• Monitoring & Observability: Native support for tracing spans and metrics (counters, histograms) for production visibility.
• Flexible Storage: Built-in providers for In-Memory, Redis, and PostgreSQL.
• Modern Security: Supports Passkeys, Backup Eligibility/State tracking, and high-security enterprise requirements.
• Safety First: Zero unsafe code policy and Rust 2024 edition compliance.

📦 Architecture

The project is split into several crates to ensure modularity:

• webauthn-core: Defines the core data structures, traits, and shared types.
• webauthn-engine: Implements the WebAuthn logic, request generation, and response verification.
• Integrations: Feature-flagged modules within the engine for specific frameworks.

🛠 Installation

Add this to your Cargo.toml:

[dependencies]
webauthn-engine = "0.1"
# For Axum integration
# webauthn-engine = { version = "0.1", features = ["axum"] }
# For Actix-web integration
# webauthn-engine = { version = "0.1", features = ["actix-web"] }

💻 Usage Example (Axum)

use webauthn_engine::WebAuthn;
use webauthn_engine::axum::axum_integration::create_webauthn_router;

// 1. Initialize the engine with your RP config
let webauthn = WebAuthn::new(rp_config, crypto_provider, store, engine_config);

// 2. Create the Axum router with WebAuthn routes
let app = Router::new()
    .nest("/api", create_webauthn_router(webauthn));

// The router provides endpoints like:
// POST /api/webauthn/register/start
// POST /api/webauthn/register/finish
// POST /api/webauthn/authenticate/start
// POST /api/webauthn/authenticate/finish

� Enterprise Features

Metadata Service (MDS)

webauthn-rs can automatically verify authenticators against the FIDO Alliance Metadata Service. This allows you to enforce security policies based on device certifications, biometric properties, and more.

Monitoring

The library is instrumented with tracing and metrics. You can easily export performance data and logs to your observability stack (e.g., Prometheus, Jaeger).

// Metrics emitted include:
// - webauthn.registration.generate_options.total
// - webauthn.registration.verify.duration_seconds
// - webauthn.authentication.verify.total

Advanced Extensions

Full support for modern extensions like prf (for encrypted drives/vaults) and largeBlob (for storing small amounts of data on the authenticator).

�🏗 Storage Backends

The library includes several built-in storage implementations:

• MemoryStore: Ideal for development and testing.
• RedisStore: High-performance session and credential storage with TTL support.
• PostgresStore: Persistent storage using PostgreSQL JSONB for flexibility.

🧪 Testing

We value quality and spec compliance. You can run the tests using:

cargo test --all-features

📜 License

This project is dual-licensed under the Apache 2.0 and MIT licenses.

---

Part of the Miya project.