webauthx AAGUID support

Verify passkey registration and inspect authenticator AAGUID metadata.

\n\n ${\n SECRET_KEY === 'replace-me-with-a-random-secret'\n ? '

Warning: SECRET_KEY is using the default placeholder. Set a Val Town environment variable named SECRET_KEY.

'\n : ''\n }\n\n

Passkey demo

\n \n

\n \n \n \n

\n\n \n\n \n\n

Session

null

\n\n \n \n`\n}\n\napp.get('/', (c) => c.html(html()))\n\napp.post(\n '/register/options',\n zValidator('json', z.object({ name: z.string().min(1).max(64) })),\n async (c) => {\n requireSecretConfigured()\n const { name } = c.req.valid('json')\n const { challenge, options } = Registration.getOptions({\n name,\n rp: { id: getRpId(c.req.url), name: 'webauthx Demo' }\n })\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/register',\n zValidator(\n 'json',\n z.object({ credential: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { credential } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const result = Registration.verify(credential, {\n challenge,\n origin: getOrigin(c.req.url),\n rpId: getRpId(c.req.url)\n })\n\n const record = {\n aaguid: result.aaguid,\n credentialId: result.credential.id,\n publicKey: result.credential.publicKey\n } satisfies CredentialRecord\n\n await putCredentialRecord(c, record)\n await setSignedCookie(\n c,\n 'session',\n result.credential.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n\n return c.json({\n authenticator: result.aaguid\n ? await Aaguid.lookup({ id: result.aaguid })\n : null,\n aaguid: result.aaguid ?? null,\n id: result.credential.id,\n publicKey: result.credential.publicKey\n })\n }\n)\n\napp.post(\n '/authenticate/options',\n zValidator(\n 'json',\n z.object({\n useAnotherProvider: z.boolean().optional()\n })\n ),\n async (c) => {\n requireSecretConfigured()\n const { useAnotherProvider } = c.req.valid('json')\n const stored = await getStoredCredentials(c)\n if (stored.credentials.length === 0) {\n return c.json({ error: 'No registered credential for this browser' }, 400)\n }\n\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n const preferredCredentialId =\n !useAnotherProvider && sessionCredentialId &&\n typeof sessionCredentialId === 'string'\n ? sessionCredentialId\n : stored.credentials[stored.credentials.length - 1]?.credentialId\n\n const { challenge, options } = Authentication.getOptions({\n ...(useAnotherProvider\n ? {}\n : preferredCredentialId\n ? { credentialId: preferredCredentialId }\n : {}),\n rpId: getRpId(c.req.url)\n })\n\n await setSignedCookie(\n c,\n 'challenge',\n challenge,\n SECRET_KEY,\n cookieOptions(c.req.url).challenge\n )\n return c.json({ options })\n }\n)\n\napp.post(\n '/authenticate',\n zValidator(\n 'json',\n z.object({ response: z.custom() })\n ),\n async (c) => {\n requireSecretConfigured()\n const { response } = c.req.valid('json')\n const challenge = (await getSignedCookie(c, SECRET_KEY, 'challenge')) as\n | `0x${string}`\n | false\n deleteCookie(c, 'challenge', { path: '/' })\n if (!challenge) {\n return c.json({ error: 'Invalid or expired challenge' }, 400)\n }\n\n const credential = await getCredentialRecord(c, response.id)\n if (!credential) return c.json({ error: 'Unknown credential' }, 400)\n\n if (\n !Authentication.verify(response, {\n challenge,\n origin: getOrigin(c.req.url),\n publicKey: credential.publicKey,\n rpId: getRpId(c.req.url)\n })\n ) {\n return c.json({ error: 'Verification failed' }, 401)\n }\n\n await setSignedCookie(\n c,\n 'session',\n response.id,\n SECRET_KEY,\n cookieOptions(c.req.url).session\n )\n return c.json({ credentialId: response.id })\n }\n)\n\napp.get('/me', async (c) => {\n const sessionCredentialId = await getSignedCookie(c, SECRET_KEY, 'session')\n if (!sessionCredentialId || typeof sessionCredentialId !== 'string') {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const credential = await getCredentialRecord(c, sessionCredentialId)\n if (!credential) {\n return c.json({ error: 'Not authenticated' }, 401)\n }\n\n const stored = await getStoredCredentials(c)\n const providers = await Promise.all(\n stored.credentials.map(async (item) => {\n const aaguid = item.aaguid ?? null\n return {\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: item.credentialId,\n publicKey: item.publicKey\n }\n })\n )\n\n const aaguid = credential.aaguid ?? null\n return c.json({\n aaguid,\n authenticator: aaguid ? await Aaguid.lookup({ id: aaguid }) : null,\n credentialId: credential.credentialId,\n publicKey: credential.publicKey,\n providers\n })\n})\n\napp.post('/logout', async (c) => {\n deleteCookie(c, 'session', { path: '/' })\n return c.json({ ok: true })\n})\n\nexport default app.fetch","webauthn-aaguid",[129],"bd523b84-3cd8-11f1-8317-42b51c65c3df","README.md","ec565a74-3cd7-11f1-860e-42b51c65c3df",16,["D",1776703701103],1,"# Val Town deployment\n\nThis folder contains a Val Town version of the demo.\n\n## Notes\n\n- It uses the `webauthx` build from `https://pkg.pr.new/webauthx@308444c`.\n- Because Val Town's runtime currently chokes on direct imports from that PR package URL, the server-side `webauthx` code used by this Val is vendored from that exact installed package into `vendor/webauthx/`.\n- It serves the UI and API from a single Val.\n- For Val Town portability, it stores the registered credential in a signed cookie instead of Cloudflare KV.\n - This means the passkey is remembered per browser profile, not in a shared server database.\n- Set a `SECRET_KEY` environment variable in Val Town before using it in production.\n\n## Create + push\n\n```sh\ncd valtown\nvt create webauth-aaguid --private --upload-if-exists\nvt push\n```\n\nThen open the Val in the browser and add an environment variable named `SECRET_KEY` in Val Town settings.\nUse a long random string.\n\nIf you rename the Val, that is fine — WebAuthn origin and RP ID are derived from the request URL at runtime.\n",[138],"bcdaef20-3cd8-11f1-9c50-42b51c65c3df","vendor","bcdaefca-3cd8-11f1-9c50-42b51c65c3df",9,["D",1776703700417],"directory",[146],"pulls","branches","forks","envVars",{"_159":142,"_161":40},"connections",{"_159":40,"_160":40},"count","unfilledCount","emptyCount",{"_18":145,"_20":146,"_114":147,"_116":-5,"_117":69,"_118":148,"_120":103,"_22":228,"_66":40,"_122":150,"_123":-5,"_125":26,"_126":-5,"_173":229,"_86":230},{"_18":223,"_20":191,"_114":218,"_116":147,"_117":69,"_118":224,"_120":103,"_22":225,"_66":40,"_122":150,"_123":-5,"_125":26,"_126":-5,"_173":226,"_86":227},{"_18":217,"_20":192,"_114":184,"_116":218,"_117":69,"_118":219,"_120":103,"_22":220,"_66":40,"_122":150,"_123":-5,"_125":26,"_126":-5,"_173":221,"_86":222},{"_18":209,"_20":210,"_114":211,"_116":184,"_117":69,"_118":212,"_120":103,"_22":213,"_66":40,"_122":187,"_123":214,"_125":26,"_126":-5,"_173":215,"_86":216},{"_18":201,"_20":202,"_114":203,"_116":184,"_117":69,"_118":204,"_120":103,"_22":205,"_66":40,"_122":187,"_123":206,"_125":26,"_126":-5,"_173":207,"_86":208},{"_18":193,"_20":194,"_114":195,"_116":184,"_117":69,"_118":196,"_120":103,"_22":197,"_66":40,"_122":187,"_123":198,"_125":26,"_126":-5,"_173":199,"_86":200},{"_18":182,"_20":129,"_114":183,"_116":184,"_117":69,"_118":185,"_120":103,"_22":186,"_66":40,"_122":187,"_123":188,"_125":26,"_126":-5,"_173":189,"_86":190},{"_18":137,"_20":138,"_114":139,"_116":-5,"_117":69,"_118":140,"_120":103,"_22":179,"_66":142,"_122":96,"_123":143,"_125":26,"_126":-5,"_173":180,"_86":181},{"_18":128,"_20":129,"_114":130,"_116":-5,"_117":69,"_118":67,"_120":103,"_22":176,"_66":132,"_122":133,"_123":134,"_125":26,"_126":135,"_173":177,"_86":178},{"_18":112,"_20":113,"_114":115,"_116":-5,"_117":69,"_118":119,"_120":103,"_22":172,"_66":40,"_122":96,"_123":124,"_125":26,"_126":-5,"_173":174,"_86":175},["D",1776703350499],"children",[],[113],["D",1776718644930],[],[129],["D",1776703701103],[],[138],"bd38460c-3cd8-11f1-8b5f-42b51c65c3df","bd3846ca-3cd8-11f1-8b5f-42b51c65c3df","bd0b6088-3cd8-11f1-8099-42b51c65c3df",14,["D",1776703701026],"script","export * as Authentication from './Authentication.ts'\nexport * as Registration from './Registration.ts'\nexport * as Aaguid from './Aaguid.ts'\n",[],[146,191,192,129],"webauthx","server","bd6bbf14-3cd8-11f1-a0fa-42b51c65c3df","Registration.ts","bd6bc00e-3cd8-11f1-a0fa-42b51c65c3df",17,["D",1776703701042],"import { Hex } from 'npm:ox@0.14.18'\nimport { Credential as Credential_, Registration } from 'npm:ox@0.14.18/webauthn'\nimport * as Aaguid from './Aaguid.ts'\n\nexport type Credential = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Registration.serializeOptions(Registration.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n credential: Credential,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n rpId?: string\n },\n) {\n const deserialized = Credential_.deserialize(credential)\n const result = Registration.verify({ ...options, credential: deserialized })\n return {\n ...Registration.serializeResponse(result),\n aaguid: Aaguid.extract(credential),\n }\n}\n",[],[146,191,192,194],"bd255dee-3cd8-11f1-9fbe-42b51c65c3df","Authentication.ts","bd255eca-3cd8-11f1-9fbe-42b51c65c3df",12,["D",1776703700901],"import { Hex, PublicKey } from 'npm:ox@0.14.18'\nimport { Authentication } from 'npm:ox@0.14.18/webauthn'\n\nexport type Response = ReturnType\n\nexport function getOptions(\n options: Parameters[0] & { challenge?: `0x${string}` } = {},\n) {\n const challenge = options.challenge ?? Hex.random(32)\n const serialized = Authentication.serializeOptions(Authentication.getOptions({ ...options, challenge }))\n return { challenge, options: serialized }\n}\n\nexport function verify(\n response: Response,\n options: {\n challenge: `0x${string}`\n origin?: string | string[]\n publicKey: `0x${string}`\n rpId?: string\n },\n) {\n const deserialized = Authentication.deserializeResponse(response)\n return Authentication.verify({\n ...options,\n metadata: deserialized.metadata,\n publicKey: PublicKey.from(options.publicKey),\n signature: deserialized.signature,\n })\n}\n",[],[146,191,192,202],"bd2b7dbe-3cd8-11f1-a19f-42b51c65c3df","Aaguid.ts","bd2b7e86-3cd8-11f1-a19f-42b51c65c3df",13,["D",1776703700906],"import { Base64, Cbor, Hex } from 'npm:ox@0.14.18'\n\nconst cache = new Map>>()\n\ntype AuthenticatorInfo = {\n iconDark?: string\n iconLight?: string\n name: string\n}\n\n/** Default remote registry. */\nexport const remoteList =\n 'https://github.com/passkeydeveloper/passkey-authenticator-aaguids/raw/refs/heads/main/combined_aaguid.json'\n\nexport function extract(credential: { attestationObject: string }) {\n try {\n const { authData } = Cbor.decode<{ authData: Uint8Array }>(\n Base64.toBytes(credential.attestationObject),\n )\n if (authData.length < 53) return undefined\n return format(authData.subarray(37, 53))\n } catch {\n return undefined\n }\n}\n\nexport async function lookup(options: {\n cache?: boolean\n fetchFn?: typeof fetch\n id: string\n remoteList?: string\n}) {\n const registry = await getRegistry(options)\n return registry[normalize(options.id)] ?? null\n}\n\nfunction format(bytes: Uint8Array) {\n const hex = Hex.fromBytes(bytes).slice(2)\n return [\n hex.slice(0, 8),\n hex.slice(8, 12),\n hex.slice(12, 16),\n hex.slice(16, 20),\n hex.slice(20, 32),\n ].join('-')\n}\n\nasync function fetchRegistry(options: { fetchFn?: typeof fetch; remoteList?: string } = {}) {\n const fetchFn = options.fetchFn ?? globalThis.fetch\n if (!fetchFn) throw new Error('`fetch` is not available in this environment.')\n\n const response = await fetchFn(options.remoteList ?? remoteList)\n if (!response.ok) {\n throw new Error(`Failed to fetch AAGUID registry: ${response.status} ${response.statusText}`)\n }\n\n const json = (await response.json()) as Record<\n string,\n { icon_dark?: string; icon_light?: string; iconDark?: string; iconLight?: string; name: string }\n >\n\n const registry: Record = {}\n for (const [id, info] of Object.entries(json)) {\n registry[normalize(id)] = {\n name: info.name,\n ...(info.iconLight || info.icon_light\n ? { iconLight: info.iconLight ?? info.icon_light }\n : {}),\n ...(info.iconDark || info.icon_dark ? { iconDark: info.iconDark ?? info.icon_dark } : {}),\n }\n }\n\n return registry\n}\n\nasync function getRegistry(options: { cache?: boolean; fetchFn?: typeof fetch; remoteList?: string }) {\n const list = options.remoteList ?? remoteList\n if (options.cache === false) return fetchRegistry({ fetchFn: options.fetchFn, remoteList: list })\n\n const cached = cache.get(list)\n if (cached) return cached\n\n const registry = fetchRegistry({\n fetchFn: options.fetchFn,\n remoteList: list,\n }).catch((error) => {\n cache.delete(list)\n throw error\n })\n\n cache.set(list, registry)\n return registry\n}\n\nfunction normalize(aaguid: string) {\n return aaguid.toLowerCase()\n}\n",[],[146,191,192,210],"bd0b5fac-3cd8-11f1-8099-42b51c65c3df","bcf4c486-3cd8-11f1-9fbe-42b51c65c3df",11,["D",1776703700736],[165,166,167,168],[146,191,192],"bcf4c3d2-3cd8-11f1-9fbe-42b51c65c3df",10,["D",1776703700587],[164],[146,191],["D",1776703700417],[163],[146],["D",1776703349741],["D",1789512647429],{"_16":17,"_84":80},{"_16":17,"_78":-5,"_79":80,"_33":34,"_81":82,"_83":26},{"_66":67,"_20":68,"_18":69,"_70":19,"_71":-5,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":21,"_77":17},"ctx",{"_59":-5,"_105":269,"_270":271,"_272":273,"_274":26,"_275":26,"_276":26,"_277":103,"_278":-5,"_279":-7,"_280":-7,"_281":40,"_282":26,"_283":26,"_284":-5,"_285":26,"_286":26,"_287":26,"_288":-5},"ENV",{"_240":241,"_242":243,"_244":68,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search