WebAuthn4J

A portable Java library for WebAuthn assertion and attestation verification

This library hasn't reached version 1. Design may change.

Documentation

You can find out more details from the reference.

Getting from Maven Central

If you are using Maven, just add the webauthn4j as a dependency:

<properties>
  ...
  <!-- Use the latest version whenever possible. -->
  <webauthn4j.version>0.6.4.RELEASE</webauthn4j.version>
  ...
</properties>

<dependencies>
  ...
  <dependency>
    <groupId>com.webauthn4j</groupId>
    <artifactId>webauthn4j-core</artifactId>
    <version>${webauthn4j.version}</version>
  </dependency>
  ...
</dependencies>

Build from source

WebAuthn4J uses a Gradle based build system. In the instructions below, gradlew is invoked from the root of the source tree and serves as a cross-platform, self-contained bootstrap mechanism for the build.

Prerequisites

• Java8 or later

Checkout sources

git clone https://github.com/webauthn4j/webauthn4j

Build all jars

./gradlew build

How to use

Verification on registration

// Client properties
byte[] clientDataJSON    = null /* set clientDataJSON */;
byte[] attestationObject = null /* set attestationObject */;

// Server properties
Origin origin          = null /* set origin */;
String rpId            = null /* set rpId */;
Challenge challenge    = null /* set challenge */;
byte[] tokenBindingId  = null /* set tokenBindingId */;
ServerProperty serverProperty = new ServerProperty(origin, rpId, challenge, tokenBindingId);

WebAuthnRegistrationContext registrationContext = new WebAuthnRegistrationContext(clientDataJSON, attestationObject, serverProperty, false);

WebAuthnRegistrationContextValidator webAuthnRegistrationContextValidator =
        WebAuthnRegistrationContextValidator.createNullAttestationStatementValidator();

webAuthnRegistrationContextValidator.validate(registrationContext);

Verification on authentication

// Client properties
byte[] credentialId      = null /* set credentialId */;
byte[] clientDataJSON    = null /* set clientDataJSON */;
byte[] authenticatorData = null /* set authenticatorData */;
byte[] signature = null /* set signature */;

// Server properties
Origin origin          = null /* set origin */;
String rpId            = null /* set rpId */;
Challenge challenge    = null /* set challenge */;
byte[] tokenBindingId  = null /* set tokenBindingId */;
ServerProperty serverProperty = new ServerProperty(origin, rpId, challenge, tokenBindingId);

WebAuthnAuthenticationContext authenticationContext =
        new WebAuthnAuthenticationContext(
                credentialId,
                clientDataJSON,
                authenticatorData,
                signature,
                serverProperty,
                true
        );
Authenticator authenticator = null /* set authenticator */;

WebAuthnAuthenticationContextValidator webAuthnAuthenticationContextValidator =
        new WebAuthnAuthenticationContextValidator();

webAuthnAuthenticationContextValidator.validate(authenticationContext, authenticator);

Sample application

Spring Security WebAuthn is built on the top of WebAuthn4J. Please see Spring Security WebAuthn sample application.

License

WebAuthn4J is Open Source software released under the Apache 2.0 license.