WebAuthn Cheat Sheet for Developers
Tags: webauthn, security, programming, cheatsheet
Published: 2024-03-20 19:32:41

WebAuthn and passkeys are the future of passwordless authentication.
Implementing passkeys requires good knowledge about the WebAuthn specification - which is everything else than user-friendly and can be tough to remember.

This cheat sheet contains everything you need to remember about WebAuthn & passkeys:

[![A 2-sided cheat sheet about WebAuthn & passkeys](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t1yq5c1ttwfh20rezrl9.png)](https://www.corbado.com/blog/passkeys-cheat-sheet)

To read the full content of the cheat sheet, head over to the [original article](https://www.corbado.com/blog/passkeys-cheat-sheet). But here's a preview of its content:

## WebAuthn Ceremonies
Authentication with passkeys is based on the two processes, also called ceremonies, **registration** (aka the “**attestation phase**”) and **login** (aka the “**assertion phase**”).
Each phase requires a random challenge generated by the server, which is signed by the authenticator and sent back to the WebAuthn server to verify the user. 

### Registration (attestation)

[![Process flow of the registration in WebAuthn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uld633i1l4hblnlrhhy4.png)](https://www.corbado.com/blog/passkeys-cheat-sheet#registration)
The registration ceremony uses two main objects: **PublicKeyCredentialCreationOptions** and **attestation**. 
Former is created by the WebAuthn server and contains instructions and settings for the new credential , aswell as other relevant data. The latter is created by the authenticator and passed back to the server, including information about the newly created credential.
To see a full JSON example of both objects, check out the [full article or cheat sheet.](https://www.corbado.com/blog/passkeys-cheat-sheet)

### Login (assertion)

[![Process flow of the login in WebAuthn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oo0naoge00v05bqz18mx.png)](https://www.corbado.com/blog/passkeys-cheat-sheet#login)
The login ceremony uses two main objects: **PublicKeyCredentialRequestOptions** and **assertion**. 
Former is created by the WebAuthn server and contains e.g. the cryptographic challenge for the authentication process. The latter is created by the authenticator and later passed  back to the server, including the signed challenge to verify ownership over the private key.
To see a full JSON example of both objects, check out the [full article or cheat sheet.](https://www.corbado.com/blog/passkeys-cheat-sheet)

##Conditional UI
Conditional UI improves the UX of passkeys by showing the user all of his available passkeys. This way he can choose a credential and doesn't even need to remember and type in his username.
The login flow with Conditional UI requires a few additional methods compared to the regular login ceremony:
![Login Flow with Conditional UI](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5evva9vmy1mbi2x5xvfd.png)

Download the [Cheat Sheet PDF](https://corbado.com/assets/Passkeys-Developer-Cheatsheet.pdf) or continue reading the [original article](https://www.corbado.com/blog/passkeys-cheat-sheet) for:

- a detailed breakdown of all objects & attributes in WebAuthn
- code examples to implement Conditional UI
- a database schema and information for implementing the WebAuthn server