search

tweag / webauthn

A library for parsing and validating webauthn/fido2 credentials
Apache License 2.0
34 stars 11 forks source link

Improve the demo #34

Closed infinisil closed 2 years ago

infinisil commented 3 years ago

The demo is currently very bare-bones and doesn't give a lot of information on what's happening. We should take inspiration or clone the demo at https://fido2-net-lib.passwordless.dev (from https://github.com/passwordless-lib/fido2-net-lib), since it does a great job.

We should also deploy the demo on the domain, see #14

lykahb commented 3 years ago

It's not a high priority, a bare-bones demo or just examples in documentation are fine.

Another, perhaps also bare-bones demo is from webauthn-json here. I think that the default JSON helpers of haskell-fido2 are compatible with github/webauthn-json (depends on #29), so reusing their demo front-end may be nearly free.

infinisil commented 2 years ago

Looking at this again, while the frontend doesn't need to look good, I think it's worthwhile to at least improve the general flow of the demo in order to show how a website can properly use webauthn for authentication. Looking at the current demo it has some properties that wouldn't fly for an actual website:

We should fix this in order to provide a good example of how to do this properly, as we don't want people to copy the server code as it is now.

I have opened https://github.com/tweag/haskell-fido2/issues/38 for this

infinisil commented 2 years ago

Demo is looking much better with above two PR's. Still to do is to improve logging, but otherwise this can be considered done.