Web Authentication (WebAuthn)

Overview

Web Authentication (WebAuthn) is a W3C web API that lets a relying party register and authenticate users with public-key credentials created and used by authenticators. WebAuthn provides the browser-facing protocol; deployment choices determine whether credentials are device-bound, synced, discoverable, attested, and combined with account recovery. It should be interpreted alongside Step Up Authentication, which may affect the same workflow without representing the same control, event, or risk.

Incorrect origin or RP ID handling, weak recovery, poor user verification policy, account enumeration, lost authenticators, and unsafe fallback methods can undermine phishing resistance.

Organizations should validate origin, RP ID, challenge, signature, credential ID, user presence or verification, sign count where useful, and bind registration and authentication to the correct account.

Retain relying party and origin, credential ID and public key, authenticator metadata where justified, challenge, verification flags, registration and authentication events, recovery, and revocation.

For Web Authentication (WebAuthn), the trust decision should establish Web Authentication (WebAuthn) is a W3C web API that lets a relying party register and authenticate users with public-key credentials created and used by authenticators and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the Web identity check and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Web Authentication (WebAuthn) should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.