Let your users sign in with a security key, a fingerprint, or the device in their hand. No password to steal, phish or reuse.
The problem it solves
A password can be guessed, leaked from another site, or handed over to a convincing fake login page. Webauthn replaces it with a key pair: the private half never leaves the user’s device, and the public half is useless to an attacker.
Because the browser checks the origin before signing anything, a phishing site simply cannot obtain a valid response. That property comes from the protocol itself, not from the user’s vigilance.
What the framework gives you
- Registration and authentication ceremonies, server side, following the W3C specification.
- Attestation checking, so you can tell what kind of authenticator was used, or decide you do not care.
- A Symfony bundle for routes, firewall integration and user handling.
- A Stimulus component for the browser side, so the front end is a few attributes rather than a script to write.
- Support for FIDO2 security keys, platform authenticators and passkeys.
Getting started
Install what you need, not the whole repository. Without a framework, take the library alone. In a Symfony application, take the bundle: it pulls the library in and adds the routes, the firewall integration and the configuration.
# Plain PHP
composer require web-auth/webauthn-lib
# Symfony
composer require web-auth/webauthn-symfony-bundleThe documentation covers the whole path, from a first registration to conditional UI. There is also a demo application built with Symfony, Tailwind and FrankenPHP if you would rather read working code.