Tag: FIDO2
-
Passkeys: what actually changes for your PHP application
Passkeys are Webauthn credentials that sync. That single difference changes your data model, your recovery flow and what you can promise your users.
-
Attestation: when you need it, and when it costs you
Attestation tells you what kind of authenticator a user holds. Most applications should ask for none, and the reasons are worth spelling out.
-
The Webauthn authentication ceremony, and what to store
Signing in is shorter than registering, but the checks are just as strict. What your database needs to hold, and what to do with the sign counter.
-
The Webauthn registration ceremony, step by step
What actually happens between clicking « add a security key » and having a credential you can trust. Six steps, and the three where implementations go wrong.