webauthx AAGUID support

Verify passkey registration and inspect authenticator AAGUID metadata.

\n\n ${\n SECRET_KEY === 'replace-me-with-a-random-secret'\n ? '

Warning: SECRET_KEY is using the default placeholder. Set a Val Town environment variable named SECRET_KEY.

'\n : ''\n }\n\n

Passkey demo

\n \n

\n \n \n \n

\n\n \n\n \n\n

Session

null

\n\n \n \n`\n}\n\napp.get('/', (c) => c.html(html()))\n\napp.post(\n '/register/options',\n zValidator('json', z.object({ name: z.string().min(1).max(64) })),\n async (c) => {\n requireSecretConfigured()\n const { name } = c.req.valid('json')\n const { challenge, options } = Registration.getOptions({\n name,\n rp: { id: getRpId(c.req.url), name: 'webauthx Demo' }\n })\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/register',\n zValidator(\n 'json',\n z.object({ credential: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { credential } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const result = Registration.verify(credential, {\n challenge,\n origin: getOrigin(c.req.url),\n rpId: getRpId(c.req.url)\n })\n\n const record = {\n aaguid: result.aaguid,\n credentialId: result.credential.id,\n publicKey: result.credential.publicKey\n } satisfies CredentialRecord\n\n await putCredentialRecord(c, record)\n await setSignedCookie(\n c,\n 'session',\n result.credential.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n\n return c.json({\n authenticator: result.aaguid\n ? await Aaguid.lookup({ id: result.aaguid })\n : null,\n aaguid: result.aaguid ?? null,\n id: result.credential.id,\n publicKey: result.credential.publicKey\n })\n }\n)\n\napp.post(\n '/authenticate/options',\n zValidator(\n 'json',\n z.object({\n useAnotherProvider: z.boolean().optional()\n })\n ),\n async (c) => {\n requireSecretConfigured()\n const { useAnotherProvider } = c.req.valid('json')\n const stored = await getStoredCredentials(c)\n if (stored.credentials.length === 0) {\n return c.json({ error: 'No registered credential for this browser' }, 400)\n }\n\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n const preferredCredentialId =\n !useAnotherProvider && sessionCredentialId &&\n typeof sessionCredentialId === 'string'\n ? sessionCredentialId\n : stored.credentials[stored.credentials.length - 1]?.credentialId\n\n const { challenge, options } = Authentication.getOptions({\n ...(useAnotherProvider\n ? {}\n : preferredCredentialId\n ? { credentialId: preferredCredentialId }\n : {}),\n rpId: getRpId(c.req.url)\n })\n\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/authenticate',\n zValidator(\n 'json',\n z.object({ response: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { response } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const credential = await getCredentialRecord(c, response.id)\n if (!credential) return c.json({ error: 'Unknown credential' }, 400)\n\n if (\n !Authentication.verify(response, {\n challenge,\n origin: getOrigin(c.req.url),\n publicKey: credential.publicKey,\n rpId: getRpId(c.req.url)\n })\n ) {\n return c.json({ error: 'Verification failed' }, 401)\n }\n\n await setSignedCookie(\n c,\n 'session',\n response.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n return c.json({ credentialId: response.id })\n }\n)\n\napp.get('/me', async (c) => {\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n if (!sessionCredentialId || typeof sessionCredentialId !== 'string') {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const credential = await getCredentialRecord(c, sessionCredentialId)\n if (!credential) {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const stored = await getStoredCredentials(c)\n const providers = await Promise.all(\n stored.credentials.map(async (item) => {\n const aaguid = item.aaguid ?? null\n return {\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: item.credentialId,\n publicKey: item.publicKey\n }\n })\n )\n\n const aaguid = credential.aaguid ?? null\n return c.json({\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: credential.credentialId,\n publicKey: credential.publicKey,\n providers\n })\n})\n\napp.post('/logout', async (c) => {\n deleteCookie(c, 'session', { path: '/' })\n return c.json({ ok: true })\n})\n\nexport default app.fetch","webauthn-aaguid",[59],"bd523b84-3cd8-11f1-8317-42b51c65c3df","README.md","ec565a74-3cd7-11f1-860e-42b51c65c3df",16,["D",1776703701103],1,"# Val Town deployment\n\nThis folder contains a Val Town version of the demo.\n\n## Notes\n\n- It uses the `webauthx` build from `https://pkg.pr.new/webauthx@308444c`.\n- Because Val Town's runtime currently chokes on direct imports from that PR package URL, the server-side `webauthx` code used by this Val is vendored from that exact installed package into `vendor/webauthx/`.\n- It serves the UI and API from a single Val.\n- For Val Town portability, it stores the registered credential in a signed cookie instead of Cloudflare KV.\n - This means the passkey is remembered per browser profile, not in a shared server database.\n- Set a `SECRET_KEY` environment variable in Val Town before using it in production.\n\n## Create + push\n\n```sh\ncd valtown\nvt create webauth-aaguid --private --upload-if-exists\nvt push\n```\n\nThen open the Val in the browser and add an environment variable named `SECRET_KEY` in Val Town settings.\nUse a long random string.\n\nIf you rename the Val, that is fine — WebAuthn origin and RP ID are derived from the request URL at runtime.\n",[69],"bcdaef20-3cd8-11f1-9c50-42b51c65c3df","vendor","bcdaefca-3cd8-11f1-9c50-42b51c65c3df",9,["D",1776703700417],"directory",[77],{"_36":76,"_13":77,"_39":78,"_41":-5,"_42":43,"_44":79,"_46":47,"_48":97,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":98,"_18":99},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":94,"_17":73,"_51":24,"_52":74,"_54":55,"_56":-5,"_88":95,"_18":96},{"_36":58,"_13":59,"_39":60,"_41":-5,"_42":43,"_44":61,"_46":47,"_48":91,"_17":63,"_51":64,"_52":65,"_54":55,"_56":66,"_88":92,"_18":93},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":87,"_17":50,"_51":24,"_52":53,"_54":55,"_56":-5,"_88":89,"_18":90},["D",1776703350499],"children",[],[38],["D",1776718644930],[],[59],["D",1776703701103],[],[69],["D",1776703700417],[100],[77],{"_36":101,"_13":102,"_39":103,"_41":78,"_42":43,"_44":104,"_46":47,"_48":105,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":106,"_18":107},"bcf4c3d2-3cd8-11f1-9fbe-42b51c65c3df","webauthx","bcf4c486-3cd8-11f1-9fbe-42b51c65c3df",10,["D",1776703700587],[108],[77,102],{"_36":109,"_13":110,"_39":111,"_41":103,"_42":43,"_44":112,"_46":47,"_48":113,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":114,"_18":115},"bd0b5fac-3cd8-11f1-8099-42b51c65c3df","server","bd0b6088-3cd8-11f1-8099-42b51c65c3df",11,["D",1776703700736],[116,117,118,119],[77,102,110],{"_36":144,"_13":145,"_39":146,"_41":111,"_42":43,"_44":147,"_46":47,"_48":148,"_17":50,"_51":124,"_52":149,"_54":55,"_56":-5,"_88":150,"_18":151},{"_36":136,"_13":137,"_39":138,"_41":111,"_42":43,"_44":139,"_46":47,"_48":140,"_17":50,"_51":124,"_52":141,"_54":55,"_56":-5,"_88":142,"_18":143},{"_36":128,"_13":129,"_39":130,"_41":111,"_42":43,"_44":131,"_46":47,"_48":132,"_17":50,"_51":124,"_52":133,"_54":55,"_56":-5,"_88":134,"_18":135},{"_36":120,"_13":59,"_39":121,"_41":111,"_42":43,"_44":122,"_46":47,"_48":123,"_17":50,"_51":124,"_52":125,"_54":55,"_56":-5,"_88":126,"_18":127},"bd38460c-3cd8-11f1-8b5f-42b51c65c3df","bd3846ca-3cd8-11f1-8b5f-42b51c65c3df",14,["D",1776703701026],"script","export * as Authentication from './Authentication.ts'\nexport * as Registration from './Registration.ts'\nexport * as Aaguid from './Aaguid.ts'\n",[],[77,102,110,59],"bd6bbf14-3cd8-11f1-a0fa-42b51c65c3df","Registration.ts","bd6bc00e-3cd8-11f1-a0fa-42b51c65c3df",17,["D",1776703701042],"import { Hex } from 'npm:ox@0.14.18'\nimport { Credential as Credential_, Registration } from 'npm:ox@0.14.18/webauthn'\nimport * as Aaguid from './Aaguid.ts'\n\nexport type Credential = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Registration.serializeOptions(Registration.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n credential: Credential,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n rpId?: string\n },\n) {\n const deserialized = Credential_.deserialize(credential)\n const result = Registration.verify({ ...options, credential: deserialized })\n return {\n ...Registration.serializeResponse(result),\n aaguid: Aaguid.extract(credential),\n }\n}\n",[],[77,102,110,129],"bd255dee-3cd8-11f1-9fbe-42b51c65c3df","Authentication.ts","bd255eca-3cd8-11f1-9fbe-42b51c65c3df",12,["D",1776703700901],"import { Hex, PublicKey } from 'npm:ox@0.14.18'\nimport { Authentication } from 'npm:ox@0.14.18/webauthn'\n\nexport type Response = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Authentication.serializeOptions(Authentication.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n response: Response,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n publicKey: `0x${string}`\n rpId?: string\n },\n) {\n const deserialized = Authentication.deserializeResponse(response)\n return Authentication.verify({\n ...options,\n metadata: deserialized.metadata,\n publicKey: PublicKey.from(options.publicKey),\n signature: deserialized.signature,\n })\n}\n",[],[77,102,110,137],"bd2b7dbe-3cd8-11f1-a19f-42b51c65c3df","Aaguid.ts","bd2b7e86-3cd8-11f1-a19f-42b51c65c3df",13,["D",1776703700906],"import { Base64, Cbor, Hex } from 'npm:ox@0.14.18'\n\nconst cache = new Map>>()\n\ntype AuthenticatorInfo = {\n iconDark?: string\n iconLight?: string\n name: string\n}\n\n/** Default remote registry. */\nexport const remoteList =\n 'https://github.com/passkeydeveloper/passkey-authenticator-aaguids/raw/refs/heads/main/combined_aaguid.json'\n\nexport function extract(credential: { attestationObject: string }) {\n try {\n const { authData } = Cbor.decode<{ authData: Uint8Array }>(\n Base64.toBytes(credential.attestationObject),\n )\n if (authData.length < 53) return undefined\n return format(authData.subarray(37, 53))\n } catch {\n return undefined\n }\n}\n\nexport async function lookup(options: {\n cache?: boolean\n fetchFn?: typeof fetch\n id: string\n remoteList?: string\n}) {\n const registry = await getRegistry(options)\n return registry[normalize(options.id)] ?? null\n}\n\nfunction format(bytes: Uint8Array) {\n const hex = Hex.fromBytes(bytes).slice(2)\n return [\n hex.slice(0, 8),\n hex.slice(8, 12),\n hex.slice(12, 16),\n hex.slice(16, 20),\n hex.slice(20, 32),\n ].join('-')\n}\n\nasync function fetchRegistry(options: { fetchFn?: typeof fetch; remoteList?: string } = {}) {\n const fetchFn = options.fetchFn ?? globalThis.fetch\n if (!fetchFn) throw new Error('`fetch` is not available in this environment.')\n\n const response = await fetchFn(options.remoteList ?? remoteList)\n if (!response.ok) {\n throw new Error(`Failed to fetch AAGUID registry: ${response.status} ${response.statusText}`)\n }\n\n const json = (await response.json()) as Record<\n string,\n { icon_dark?: string; icon_light?: string; iconDark?: string; iconLight?: string; name: string }\n >\n\n const registry: Record = {}\n for (const [id, info] of Object.entries(json)) {\n registry[normalize(id)] = {\n name: info.name,\n ...(info.iconLight || info.icon_light\n ? { iconLight: info.iconLight ?? info.icon_light }\n : {}),\n ...(info.iconDark || info.icon_dark ? { iconDark: info.iconDark ?? info.icon_dark } : {}),\n }\n }\n\n return registry\n}\n\nasync function getRegistry(options: { cache?: boolean; fetchFn?: typeof fetch; remoteList?: string }) {\n const list = options.remoteList ?? remoteList\n if (options.cache === false) return fetchRegistry({ fetchFn: options.fetchFn, remoteList: list })\n\n const cached = cache.get(list)\n if (cached) return cached\n\n const registry = fetchRegistry({\n fetchFn: options.fetchFn,\n remoteList: list,\n }).catch((error) => {\n cache.delete(list)\n throw error\n })\n\n cache.set(list, registry)\n return registry\n}\n\nfunction normalize(aaguid: string) {\n return aaguid.toLowerCase()\n}\n",[],[77,102,110,145],"ebd53da4-3cd7-11f1-a6ee-42b51c65c3df",["D",1776703349741],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","b9e6ccc7-499e-4c99-99f6-d52e7b324153","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","b2100bc6-baf7-410d-9bc0-a9181ab0c74f","tursoName","ebd53da43cd711f1a6ee42b51c65c3df","tursoHostname","ebd53da43cd711f1a6ee42b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789512647429],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_207":203},"org",{"_11":12,"_201":-5,"_202":203,"_161":162,"_204":205,"_206":55},"branch",{"_17":61,"_13":16,"_36":43,"_193":152,"_194":-5,"_195":-5,"_196":-5,"_197":-5,"_198":-5,"_199":14,"_200":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/f71f69b9-f78f-40f4-11db-501b802a0900/square512?exp=1789545599&sig=fb41e4c57476b90e09f10c1dc100fc62a7a10e92a1411721281956dbd2a863e1","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":152,"_13":14,"_48":273,"_154":-5,"_155":55,"_156":157,"_158":157,"_159":19,"_160":-5,"_161":162,"_163":-5,"_164":55,"_165":-5,"_166":-5,"_167":50,"_168":169,"_170":171,"_172":173,"_174":274,"_176":-5,"_177":178,"_179":178,"_180":181,"_182":181,"_183":181,"_184":178,"_185":178,"_186":275,"_188":276,"_190":277,"_192":55},[243,250,251,252],"files",[243,244,245,246,247,248,249,250,251,252],"counts",{"_234":50,"_235":73,"_236":50,"_31":237,"_238":239},[226,227,228,229],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_36":76,"_13":77,"_39":78,"_41":-5,"_42":43,"_44":79,"_46":47,"_48":80,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_18":233},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":72,"_17":73,"_51":24,"_52":74,"_54":55,"_56":-5,"_18":232},{"_36":58,"_13":59,"_39":60,"_41":-5,"_42":43,"_44":61,"_46":47,"_48":62,"_17":63,"_51":64,"_52":65,"_54":55,"_56":66,"_18":231},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":49,"_17":50,"_51":24,"_52":53,"_54":55,"_56":-5,"_18":230},[38],[59],[69],[77],"pulls","branches","forks",{"_240":73,"_242":50},"connections",{"_240":50,"_241":50},"count","unfilledCount","emptyCount",{"_36":76,"_13":77,"_39":78,"_41":-5,"_42":43,"_44":79,"_46":47,"_48":97,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":271,"_18":272},{"_36":101,"_13":102,"_39":103,"_41":78,"_42":43,"_44":104,"_46":47,"_48":105,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":269,"_18":270},{"_36":109,"_13":110,"_39":111,"_41":103,"_42":43,"_44":112,"_46":47,"_48":113,"_17":50,"_51":81,"_52":-5,"_54":55,"_56":-5,"_88":267,"_18":268},{"_36":144,"_13":145,"_39":146,"_41":111,"_42":43,"_44":147,"_46":47,"_48":148,"_17":50,"_51":124,"_52":149,"_54":55,"_56":-5,"_88":265,"_18":266},{"_36":136,"_13":137,"_39":138,"_41":111,"_42":43,"_44":139,"_46":47,"_48":140,"_17":50,"_51":124,"_52":141,"_54":55,"_56":-5,"_88":263,"_18":264},{"_36":128,"_13":129,"_39":130,"_41":111,"_42":43,"_44":131,"_46":47,"_48":132,"_17":50,"_51":124,"_52":133,"_54":55,"_56":-5,"_88":261,"_18":262},{"_36":120,"_13":59,"_39":121,"_41":111,"_42":43,"_44":122,"_46":47,"_48":123,"_17":50,"_51":124,"_52":125,"_54":55,"_56":-5,"_88":259,"_18":260},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":94,"_17":73,"_51":24,"_52":74,"_54":55,"_56":-5,"_88":257,"_18":258},{"_36":58,"_13":59,"_39":60,"_41":-5,"_42":43,"_44":61,"_46":47,"_48":91,"_17":63,"_51":64,"_52":65,"_54":55,"_56":66,"_88":255,"_18":256},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":87,"_17":50,"_51":24,"_52":53,"_54":55,"_56":-5,"_88":253,"_18":254},[],[38],[],[59],[],[69],[],[77,102,110,59],[],[77,102,110,129],[],[77,102,110,137],[],[77,102,110,145],[246,247,248,249],[77,102,110],[245],[77,102],[244],[77],["D",1776703349741],["D",1789512647429],{"_11":12,"_207":203},{"_11":12,"_201":-5,"_202":203,"_161":162,"_204":205,"_206":55},{"_17":61,"_13":16,"_36":43,"_193":152,"_194":-5,"_195":-5,"_196":-5,"_197":-5,"_198":-5,"_199":14,"_200":12},"ctx",{"_186":-5,"_223":311,"_312":313,"_314":315,"_316":55,"_317":55,"_318":55,"_319":47,"_320":-5,"_321":-7,"_322":-7,"_323":50,"_324":55,"_325":55,"_326":-5,"_327":55,"_328":55,"_329":55,"_330":-5},"ENV",{"_282":283,"_284":285,"_286":16,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302,"_303":304,"_305":306,"_307":308,"_309":310},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code