# Django OTP WebAuthn
[](https://pypi.python.org/pypi/django-otp-webauthn/)
[](https://opensource.org/licenses/BSD-3-Clause)
[](https://github.com/Stormbase/django-otp-webauthn/actions/workflows/test.yml)
[](https://codecov.io/gh/Stormheg/django-otp-webauthn)
[](#contributors)
This package provides an implementation of [WebAuthn Passkeys](https://passkeys.dev/) for Django. It is written as a plugin for the [Django OTP framework](https://github.com/django-otp/django-otp) for multi-factor authentication. Under the hood, this package uses [py_webauth](https://github.com/duo-labs/py_webauthn/) to handle all cryptographic operations.
> [!IMPORTANT]
> This package is in development not yet thoroughly tested and documented. The API is subject to change. If you are interested in using this package, please star this repository to show your interest. This will help me prioritize development. If you are interested in contributing, please see the [DEVELOPMENT.md](DEVELOPMENT.md) file.
- [Django OTP WebAuthn](#django-otp-webauthn)
- [Compatibility](#compatibility)
- [Browser compatibility](#browser-compatibility)
- [Features](#features)
- [Quick start guide - how to use Passkeys in your Django project](#quick-start-guide---how-to-use-passkeys-in-your-django-project)
- [Using custom credential and attestation models](#using-custom-credential-and-attestation-models)
- [What exactly is a Passkey?](#what-exactly-is-a-passkey)
- [How Passkeys work (in a nutshell)](#how-passkeys-work-in-a-nutshell)
- [Why use Passkeys?](#why-use-passkeys)
- [A note about security](#a-note-about-security)
- [Who uses Passkeys?](#who-uses-passkeys)
- [Further reading](#further-reading)
- [Development](#development)
- [License](#license)
## Compatibility
- Django >= 4.2
- Python >= 3.9
- django-otp >= 1.4.0
### Browser compatibility
Passkeys are supported in most modern browsers. Here is a list of browsers that support Passkeys:
- Chrome 67+
- Firefox 60+
- Safari 13+
- Microsoft Edge 18+
For a complete list, see [caniuse.com/webauthn](https://caniuse.com/webauthn).
## Features
- **Passkeys as a second factor.** Lets users just click yes on the browser prompt to verify their identity after they have entered their password.
- **Passwordless login with Passkeys (optional).** Lets users verify their identity using a biometric sensor, security key, or other compatible device. Can be disabled if you prefer to use Passkeys as a second factor only.
- **Batteries included.** comes with a default frontend JavaScript implementation that works out of the box and removes complexity for you.
- **Flexible frontend.** you can style the fronted implementation to fit your brand. Or roll your own frontend implementation if you need something more custom.
- **Compatible with strict [Content Security Policy (CSP)](https://content-security-policy.com/).** The frontend implementation does not rely on inline scripts and is compatible with strict CSP settings.
## Quick start guide - how to use Passkeys in your Django project
To quickly start using Passkeys in your Django project, follow these steps:
1. Install the package from PyPI:
```bash
pip install django-otp-webauthn
```
2. Add `django_otp_webauthn` to your `INSTALLED_APPS` in your Django settings:
```python
INSTALLED_APPS = [
...
"django_otp_webauthn",
...
]
```
3. Add the required URLs to your Django project:
```python
# urls.py
from django.urls import include, path
urlpatterns = [
...
path("webauthn/", include("django_otp_webauthn.urls", namespace="otp_webauthn")),
...
]
```
4. Add required settings to your Django settings. This example assumes you want to configure for `localhost`. You will need to adjust the settings for your production environment.
```python
# settings.py
# The name of the relying party (RP). This is sometimes shown to the user when they register a Passkey.
OTP_WEBAUTHN_RP_NAME = "My Website Inc."
# This is necessary to bind the Passkey to a specific domain. This should be the domain of your website.
OTP_WEBAUTHN_RP_ID = "your-domain.com"
# This is used to check the origin of the request and is used for security. It is similar to Django's CSRF_TRUSTED_ORIGINS setting.
# The origins must always be a subdomain of the RP ID or the RP ID itself.
OTP_WEBAUTHN_ALLOWED_ORIGINS = ["https://your-domain.com", "https://subdomain.your-domain.com"]
```
5. Add `django_otp_webauthn.backends.WebAuthnBackend` to `AUTHENTICATION_BACKENDS` in your Django settings. This step is required to make 'passwordless authentication' work.
If you are exclusively using Passkeys as a secondary verification step, you don't have to add this backend.
```python
AUTHENTICATION_BACKENDS = [
...
"django_otp_webauthn.backends.WebAuthnBackend",
...
]
```
6. Add the registration code to your logged-in user template.
```html
<!-- logged_in_template.html -->
{% load otp_webauthn %}
{% comment %}
This template is displayed when WebAuthn registration is supported.
The template must contain a button with the id `passkey-register-button`. To display status and error messages, include an element with the id `passkey-register-status-message`.
{% endcomment %}
<template id="passkey-registration-available-template">
<div>
<button type="button" id="passkey-register-button">Register Passkey</button>
<div id="passkey-register-status-message"></div>
</div>
</template>
{% comment %}
This template is displayed when WebAuthn registration is not supported.
{% endcomment %}
<template id="passkey-registration-unavailable-template">
<p>Sorry, your browser has no Passkey support</p>
</template>
{% comment %}
This placeholder element will be replaced with either the contents of the `passkey-registration-available-template` or the `passkey-registration-unavailable-template` template.
{% endcomment %}
<span id="passkey-registration-placeholder"></span>
{% comment %}
This template tag renders all the necessary <script> tags for the default registration implementation
{% endcomment %}
{% render_otp_webauthn_register_scripts %}
```
7. On your login page, include the following to enable passwordless login:
```html
{% load otp_webauthn %}
<form method="post">
{# Suppose there is an username field on your page that has CSS selector: input[name="username"] #}
<label for="id_username">Username</label>
<input id="id_username" type="text" name="username" autocomplete="username">
{# Other fields omitted for brevity #}
{# This placeholder element will be replaced with either the contents of the `passkey-verification-available-template` or the `passkey-verification-unavailable-template` template. #}
<span id="passkey-verification-placeholder"></span>
{% comment %}
This template is displayed when WebAuthn authentication is supported. Typically, you would want to display a button that the user can click to authenticate using a Passkey.
The template must contain a button with the id `passkey-verification-button`. To display status and error messages, include an element with the id `passkey-verification-status-message`.
{% endcomment %}
<template id="passkey-verification-available-template">
<button type="button" id="passkey-verification-button">Login using a Passkey</button>
<div id="passkey-verification-status-message"></div>
</template>
{% comment %}
This template is displayed when WebAuthn is not supported.
{% endcomment %}
<template id="passkey-verification-unavailable-template">
<p>Sorry, your browser has no Passkey support</p>
</template>
{% comment %}
This template tag renders all the necessary <script> tags for the default verification implementation
To make browsers automatically suggest a Passkey when you focus the username
field, make sure `username_field_selector` is a valid CSS selector.
The username_field_selector parameter is only required to make 'passwordless authentication' work.
{% endcomment %}
{% render_otp_webauthn_auth_scripts username_field_selector="input[name='username']" %}
</form>
```
8. Don't forget to run migrations:
```sh
python manage.py migrate
```
9. That's it! You should now see a "Register Passkey" button on your logged-in user template. Clicking this button will start the registration process. After registration, you should see a "Login using a Passkey" button on your login page. Clicking this button will prompt you to use your Passkey to authenticate. Or if your browser supports it, you will be prompted to use your Passkey when you focus the username field.
## Using custom credential and attestation models.
Django OTP WebAuthn provides its own models for credentials and attestations for those credentials. If these do not suit your needs you can also provide your own models. When using a custom credential model them you _must_ use a custom attestation model as well.
Two abstract base models exist with all of the required fields and methods implemented, `django_otp_webauthn.models.AbstractWebAuthnCredential` and `django_otp_webauthn.models.AbstractWebAuthnAttestation`. Your custom attestation will need to override the `credential` field to related back to your own credential model.
```python
from django.db import models
from django_otp_webauthn.models import AbstractWebAuthnAttestation, AbstractWebAuthnCredential
class MyCredential(AbstractWebAuthnCredential):
pass
class MyAttestation(AbstractWebAuthnAttestation):
credential=models.OneToOneField(MyCredential, on_delete=models.CASCADE, related_name="attestation", editable=False)
```
The `AbstractWebAuthnCredential` model creates an index with a name which includes the concrete model's name with `_sha256_idx` appended to the end. If this combination is longer than 30 characters then you will also need to override the index on your credential model to ensure an appropriate length for the index name.
```python
class MyCredentialModelWithALongName(AbstractWebAuthnCredential):
class Meta:
indexes = [
models.Index(fields=["credential_id_sha256"], name="mycredential_id_sha256_idx"),
]
```
You can also override only the attestation model without any changes to the credential model. When doing so you will still need to implement the `credential` field to use a `related_name` other than `attestation` to avoid a conflict with the `related_name` property of the default model.
```python
from django.db import models
from django_otp_webauthn.models import AbstractWebAuthnAttestation
class MyAttestation(AbstractWebAuthnAttestation):
credential=models.OneToOneField("otp_webauthn.WebAuthnCredential", on_delete=models.CASCADE, related_name="swapped_attestation", editable=False)
```
## What exactly is a Passkey?
Passkeys are a new way to authenticate on the web. Officially they are called 'WebAuthn credentials', but Passkeys are the more memorable, human-friendly name, that has been chosen to describe them. They allow users of your site to use their phone, laptop, security key, or other compatible device to authenticate without having to remember a password.
Passkeys follow the [WebAuthn](https://www.w3.org/TR/webauthn-3/) standard. The standard describes a way to use [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) to authenticate users.
### How Passkeys work (in a nutshell)
Here is an (overly simplified) explanation of how Passkeys work. For a more detailed explanation, try [Auth0's interactive WebAuthn demo](https://webauthn.me/). It has a very nice explanation of the WebAuthn flow! Or dive into the [WebAuthn standard](https://www.w3.org/TR/webauthn-3/) itself.
1. An already authenticated user registers a Passkey with your site. A public-private key pair is generated on the user's device. The private key is stored securely and the public key is sent to the server and associated with the authenticated user. An additional piece of information is also stored on the server, called the 'credential ID'.
2. When a user wants to authenticate, the server sends a challenge to the user's device. The user's device signs the challenge with the private key and sends the signature back to the server along with the credential ID.
3. The server looks up the public key associated with the given credential ID and uses it to check the signature. Was this signature generated by the private key that belongs to the public key we have on file? If yes, the user must be in possession of the private key and is authenticated.
### Why use Passkeys?
- **Security.** Compared to passwords, Passkeys are resistant to phishing attacks, credential stuffing, and other common attacks.
- **Convenience.** Passkeys are more convenient than passwords. Users don't have to choose and remember a password, they can use their phone, laptop, or security key to authenticate. Compared to other traditional forms of Multi Factor Authentication, there is no need to wait for an SMS code to arrive or copy a code from an authenticator app. Just click yes on the browser prompt.
### A note about security
Passkeys are sometimes claimed to be silver bullet for security. While they are more secure than passwords, they are not perfect.
You put trust in the user's device and its manufacturer. Most devices support some form of syncing Passkeys between devices, like through an iCloud or Google account. This means that if someone gains access to the users' iCloud or Google account, they could potentially access their Passkeys. Users that have poorly secured their account and devices are at risk. However, this is not unique to Passkeys. The same risks exists for password managers and other forms of Multi Factor Authentication that support syncing between devices. Passkeys improve over other methods by their resistance to phishing attacks, credential stuffing and their convenience.
It is the author's opinion that the benefits of Passkeys outweigh the risks. This section is here for your own consideration.
## Who uses Passkeys?
Plenty of websites already support Passkeys. Here are some well known examples:
- [GitHub](https://docs.github.com/en/authentication/authenticating-with-a-passkey/signing-in-with-a-passkey)
- [Google](https://support.google.com/accounts/answer/13548313?hl=en)
- [Microsoft](https://support.microsoft.com/en-us/account-billing/set-up-a-security-key-as-your-verification-method-2911cacd-efa5-4593-ae22-e09ae14c6698)
- [Whatsapp](https://www.threads.net/@wcathcart/post/Cyd27d7pex8)
It is about time for your website to support Passkeys too!
## Further reading
Here are some good resources to learn more about Passkeys:
- [Passkeys.dev](https://passkeys.dev/) - general information about Passkeys
- [Auth0's WebAuthn demo](https://webauthn.me/) - has a very nice explanation of the WebAuthn flow!
- [The WebAuthn standard (working draft)](https://www.w3.org/TR/webauthn-3/)
## Development
See [DEVELOPMENT.md](DEVELOPMENT.md) for information on how to develop and contribute to this project.
## License
This project is licensed under the BSD 3-Clause License. See the [LICENSE](LICENSE) file for details.
Raw data
{
"_id": null,
"home_page": null,
"name": "django-otp-webauthn",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.9",
"maintainer_email": null,
"keywords": "authentication, django, django-otp, fido2, mfa, security, u2f, webauthn",
"author": null,
"author_email": "\"Storm B. Heg\" <storm@stormbase.digital>",
"download_url": "https://files.pythonhosted.org/packages/04/96/02b37b216240572ce2a44959c525103f5aa8e029fce3b109cc40633f23c3/django_otp_webauthn-0.4.0.tar.gz",
"platform": null,
"description": "# Django OTP WebAuthn\n\n[](https://pypi.python.org/pypi/django-otp-webauthn/)\n[](https://opensource.org/licenses/BSD-3-Clause)\n[](https://github.com/Stormbase/django-otp-webauthn/actions/workflows/test.yml)\n[](https://codecov.io/gh/Stormheg/django-otp-webauthn)\n[](#contributors)\n\nThis package provides an implementation of [WebAuthn Passkeys](https://passkeys.dev/) for Django. It is written as a plugin for the [Django OTP framework](https://github.com/django-otp/django-otp) for multi-factor authentication. Under the hood, this package uses [py_webauth](https://github.com/duo-labs/py_webauthn/) to handle all cryptographic operations.\n\n> [!IMPORTANT]\n> This package is in development not yet thoroughly tested and documented. The API is subject to change. If you are interested in using this package, please star this repository to show your interest. This will help me prioritize development. If you are interested in contributing, please see the [DEVELOPMENT.md](DEVELOPMENT.md) file.\n\n- [Django OTP WebAuthn](#django-otp-webauthn)\n - [Compatibility](#compatibility)\n - [Browser compatibility](#browser-compatibility)\n - [Features](#features)\n - [Quick start guide - how to use Passkeys in your Django project](#quick-start-guide---how-to-use-passkeys-in-your-django-project)\n - [Using custom credential and attestation models](#using-custom-credential-and-attestation-models)\n - [What exactly is a Passkey?](#what-exactly-is-a-passkey)\n - [How Passkeys work (in a nutshell)](#how-passkeys-work-in-a-nutshell)\n - [Why use Passkeys?](#why-use-passkeys)\n - [A note about security](#a-note-about-security)\n - [Who uses Passkeys?](#who-uses-passkeys)\n - [Further reading](#further-reading)\n - [Development](#development)\n - [License](#license)\n\n## Compatibility\n\n- Django >= 4.2\n- Python >= 3.9\n- django-otp >= 1.4.0\n\n### Browser compatibility\n\nPasskeys are supported in most modern browsers. Here is a list of browsers that support Passkeys:\n\n- Chrome 67+\n- Firefox 60+\n- Safari 13+\n- Microsoft Edge 18+\n\nFor a complete list, see [caniuse.com/webauthn](https://caniuse.com/webauthn).\n\n## Features\n\n- **Passkeys as a second factor.** Lets users just click yes on the browser prompt to verify their identity after they have entered their password.\n- **Passwordless login with Passkeys (optional).** Lets users verify their identity using a biometric sensor, security key, or other compatible device. Can be disabled if you prefer to use Passkeys as a second factor only.\n- **Batteries included.** comes with a default frontend JavaScript implementation that works out of the box and removes complexity for you.\n- **Flexible frontend.** you can style the fronted implementation to fit your brand. Or roll your own frontend implementation if you need something more custom.\n- **Compatible with strict [Content Security Policy (CSP)](https://content-security-policy.com/).** The frontend implementation does not rely on inline scripts and is compatible with strict CSP settings.\n\n## Quick start guide - how to use Passkeys in your Django project\n\nTo quickly start using Passkeys in your Django project, follow these steps:\n\n1. Install the package from PyPI:\n\n ```bash\n pip install django-otp-webauthn\n ```\n\n2. Add `django_otp_webauthn` to your `INSTALLED_APPS` in your Django settings:\n\n ```python\n INSTALLED_APPS = [\n ...\n \"django_otp_webauthn\",\n ...\n ]\n ```\n\n3. Add the required URLs to your Django project:\n\n ```python\n # urls.py\n\n from django.urls import include, path\n\n urlpatterns = [\n ...\n path(\"webauthn/\", include(\"django_otp_webauthn.urls\", namespace=\"otp_webauthn\")),\n ...\n ]\n ```\n\n4. Add required settings to your Django settings. This example assumes you want to configure for `localhost`. You will need to adjust the settings for your production environment.\n\n ```python\n # settings.py\n\n # The name of the relying party (RP). This is sometimes shown to the user when they register a Passkey.\n OTP_WEBAUTHN_RP_NAME = \"My Website Inc.\"\n # This is necessary to bind the Passkey to a specific domain. This should be the domain of your website.\n OTP_WEBAUTHN_RP_ID = \"your-domain.com\"\n # This is used to check the origin of the request and is used for security. It is similar to Django's CSRF_TRUSTED_ORIGINS setting.\n # The origins must always be a subdomain of the RP ID or the RP ID itself.\n OTP_WEBAUTHN_ALLOWED_ORIGINS = [\"https://your-domain.com\", \"https://subdomain.your-domain.com\"]\n\n ```\n\n5. Add `django_otp_webauthn.backends.WebAuthnBackend` to `AUTHENTICATION_BACKENDS` in your Django settings. This step is required to make 'passwordless authentication' work.\n\nIf you are exclusively using Passkeys as a secondary verification step, you don't have to add this backend.\n\n ```python\n AUTHENTICATION_BACKENDS = [\n ...\n \"django_otp_webauthn.backends.WebAuthnBackend\",\n ...\n ]\n ```\n\n6. Add the registration code to your logged-in user template.\n\n ```html\n <!-- logged_in_template.html -->\n {% load otp_webauthn %}\n\n {% comment %}\n This template is displayed when WebAuthn registration is supported.\n The template must contain a button with the id `passkey-register-button`. To display status and error messages, include an element with the id `passkey-register-status-message`.\n {% endcomment %}\n <template id=\"passkey-registration-available-template\">\n <div>\n <button type=\"button\" id=\"passkey-register-button\">Register Passkey</button>\n <div id=\"passkey-register-status-message\"></div>\n </div>\n </template>\n\n {% comment %}\n This template is displayed when WebAuthn registration is not supported.\n {% endcomment %}\n <template id=\"passkey-registration-unavailable-template\">\n <p>Sorry, your browser has no Passkey support</p>\n </template>\n\n {% comment %}\n This placeholder element will be replaced with either the contents of the `passkey-registration-available-template` or the `passkey-registration-unavailable-template` template.\n {% endcomment %}\n <span id=\"passkey-registration-placeholder\"></span>\n\n {% comment %}\n This template tag renders all the necessary <script> tags for the default registration implementation\n {% endcomment %}\n {% render_otp_webauthn_register_scripts %}\n ```\n\n7. On your login page, include the following to enable passwordless login:\n\n ```html\n {% load otp_webauthn %}\n\n <form method=\"post\">\n {# Suppose there is an username field on your page that has CSS selector: input[name=\"username\"] #}\n <label for=\"id_username\">Username</label>\n <input id=\"id_username\" type=\"text\" name=\"username\" autocomplete=\"username\">\n {# Other fields omitted for brevity #}\n\n {# This placeholder element will be replaced with either the contents of the `passkey-verification-available-template` or the `passkey-verification-unavailable-template` template. #}\n <span id=\"passkey-verification-placeholder\"></span>\n\n {% comment %}\n This template is displayed when WebAuthn authentication is supported. Typically, you would want to display a button that the user can click to authenticate using a Passkey.\n The template must contain a button with the id `passkey-verification-button`. To display status and error messages, include an element with the id `passkey-verification-status-message`.\n {% endcomment %}\n <template id=\"passkey-verification-available-template\">\n <button type=\"button\" id=\"passkey-verification-button\">Login using a Passkey</button>\n <div id=\"passkey-verification-status-message\"></div>\n </template>\n\n\n {% comment %}\n This template is displayed when WebAuthn is not supported.\n {% endcomment %}\n <template id=\"passkey-verification-unavailable-template\">\n <p>Sorry, your browser has no Passkey support</p>\n </template>\n\n {% comment %}\n This template tag renders all the necessary <script> tags for the default verification implementation\n\n To make browsers automatically suggest a Passkey when you focus the username\n field, make sure `username_field_selector` is a valid CSS selector.\n\n The username_field_selector parameter is only required to make 'passwordless authentication' work.\n {% endcomment %}\n {% render_otp_webauthn_auth_scripts username_field_selector=\"input[name='username']\" %}\n </form>\n ```\n\n8. Don't forget to run migrations:\n\n ```sh\n python manage.py migrate\n ```\n\n9. That's it! You should now see a \"Register Passkey\" button on your logged-in user template. Clicking this button will start the registration process. After registration, you should see a \"Login using a Passkey\" button on your login page. Clicking this button will prompt you to use your Passkey to authenticate. Or if your browser supports it, you will be prompted to use your Passkey when you focus the username field.\n\n## Using custom credential and attestation models.\n\nDjango OTP WebAuthn provides its own models for credentials and attestations for those credentials. If these do not suit your needs you can also provide your own models. When using a custom credential model them you _must_ use a custom attestation model as well.\n\nTwo abstract base models exist with all of the required fields and methods implemented, `django_otp_webauthn.models.AbstractWebAuthnCredential` and `django_otp_webauthn.models.AbstractWebAuthnAttestation`. Your custom attestation will need to override the `credential` field to related back to your own credential model.\n\n```python\nfrom django.db import models\nfrom django_otp_webauthn.models import AbstractWebAuthnAttestation, AbstractWebAuthnCredential\n\nclass MyCredential(AbstractWebAuthnCredential):\n pass\n\n\nclass MyAttestation(AbstractWebAuthnAttestation):\n credential=models.OneToOneField(MyCredential, on_delete=models.CASCADE, related_name=\"attestation\", editable=False)\n```\n\nThe `AbstractWebAuthnCredential` model creates an index with a name which includes the concrete model's name with `_sha256_idx` appended to the end. If this combination is longer than 30 characters then you will also need to override the index on your credential model to ensure an appropriate length for the index name.\n\n```python\nclass MyCredentialModelWithALongName(AbstractWebAuthnCredential):\n\n class Meta:\n indexes = [\n models.Index(fields=[\"credential_id_sha256\"], name=\"mycredential_id_sha256_idx\"),\n ]\n```\n\nYou can also override only the attestation model without any changes to the credential model. When doing so you will still need to implement the `credential` field to use a `related_name` other than `attestation` to avoid a conflict with the `related_name` property of the default model.\n\n```python\nfrom django.db import models\nfrom django_otp_webauthn.models import AbstractWebAuthnAttestation\n\nclass MyAttestation(AbstractWebAuthnAttestation):\n credential=models.OneToOneField(\"otp_webauthn.WebAuthnCredential\", on_delete=models.CASCADE, related_name=\"swapped_attestation\", editable=False)\n\n```\n\n## What exactly is a Passkey?\n\nPasskeys are a new way to authenticate on the web. Officially they are called 'WebAuthn credentials', but Passkeys are the more memorable, human-friendly name, that has been chosen to describe them. They allow users of your site to use their phone, laptop, security key, or other compatible device to authenticate without having to remember a password.\n\nPasskeys follow the [WebAuthn](https://www.w3.org/TR/webauthn-3/) standard. The standard describes a way to use [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) to authenticate users.\n\n### How Passkeys work (in a nutshell)\n\nHere is an (overly simplified) explanation of how Passkeys work. For a more detailed explanation, try [Auth0's interactive WebAuthn demo](https://webauthn.me/). It has a very nice explanation of the WebAuthn flow! Or dive into the [WebAuthn standard](https://www.w3.org/TR/webauthn-3/) itself.\n\n1. An already authenticated user registers a Passkey with your site. A public-private key pair is generated on the user's device. The private key is stored securely and the public key is sent to the server and associated with the authenticated user. An additional piece of information is also stored on the server, called the 'credential ID'.\n2. When a user wants to authenticate, the server sends a challenge to the user's device. The user's device signs the challenge with the private key and sends the signature back to the server along with the credential ID.\n3. The server looks up the public key associated with the given credential ID and uses it to check the signature. Was this signature generated by the private key that belongs to the public key we have on file? If yes, the user must be in possession of the private key and is authenticated.\n\n### Why use Passkeys?\n\n- **Security.** Compared to passwords, Passkeys are resistant to phishing attacks, credential stuffing, and other common attacks.\n- **Convenience.** Passkeys are more convenient than passwords. Users don't have to choose and remember a password, they can use their phone, laptop, or security key to authenticate. Compared to other traditional forms of Multi Factor Authentication, there is no need to wait for an SMS code to arrive or copy a code from an authenticator app. Just click yes on the browser prompt.\n\n### A note about security\n\nPasskeys are sometimes claimed to be silver bullet for security. While they are more secure than passwords, they are not perfect.\n\nYou put trust in the user's device and its manufacturer. Most devices support some form of syncing Passkeys between devices, like through an iCloud or Google account. This means that if someone gains access to the users' iCloud or Google account, they could potentially access their Passkeys. Users that have poorly secured their account and devices are at risk. However, this is not unique to Passkeys. The same risks exists for password managers and other forms of Multi Factor Authentication that support syncing between devices. Passkeys improve over other methods by their resistance to phishing attacks, credential stuffing and their convenience.\n\nIt is the author's opinion that the benefits of Passkeys outweigh the risks. This section is here for your own consideration.\n\n## Who uses Passkeys?\n\nPlenty of websites already support Passkeys. Here are some well known examples:\n\n- [GitHub](https://docs.github.com/en/authentication/authenticating-with-a-passkey/signing-in-with-a-passkey)\n- [Google](https://support.google.com/accounts/answer/13548313?hl=en)\n- [Microsoft](https://support.microsoft.com/en-us/account-billing/set-up-a-security-key-as-your-verification-method-2911cacd-efa5-4593-ae22-e09ae14c6698)\n- [Whatsapp](https://www.threads.net/@wcathcart/post/Cyd27d7pex8)\n\nIt is about time for your website to support Passkeys too!\n\n## Further reading\n\nHere are some good resources to learn more about Passkeys:\n\n- [Passkeys.dev](https://passkeys.dev/) - general information about Passkeys\n- [Auth0's WebAuthn demo](https://webauthn.me/) - has a very nice explanation of the WebAuthn flow!\n- [The WebAuthn standard (working draft)](https://www.w3.org/TR/webauthn-3/)\n\n## Development\n\nSee [DEVELOPMENT.md](DEVELOPMENT.md) for information on how to develop and contribute to this project.\n\n## License\n\nThis project is licensed under the BSD 3-Clause License. See the [LICENSE](LICENSE) file for details.\n",
"bugtrack_url": null,
"license": null,
"summary": "FIDO2 WebAuthn support for django-otp: lets your users authenticate with Passkeys",
"version": "0.4.0",
"project_urls": {
"Changelog": "https://github.com/Stormbase/django-otp-webauthn/blob/main/CHANGELOG.md",
"Issues": "https://github.com/Stormbase/django-otp-webauthn/issues",
"Source": "https://github.com/Stormbase/django-otp-webauthn"
},
"split_keywords": [
"authentication",
" django",
" django-otp",
" fido2",
" mfa",
" security",
" u2f",
" webauthn"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "e666c241c2f8807092ac009f9be1e86364719320355795de2491e65bbe6eb8f9",
"md5": "28c029af1acdaa92ff0a3a29c99211f7",
"sha256": "32267e2fa161e313360e08427a647698ea3dbe526c37067e6b5abbb43adf73b1"
},
"downloads": -1,
"filename": "django_otp_webauthn-0.4.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "28c029af1acdaa92ff0a3a29c99211f7",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.9",
"size": 70511,
"upload_time": "2024-10-27T18:21:40",
"upload_time_iso_8601": "2024-10-27T18:21:40.016392Z",
"url": "https://files.pythonhosted.org/packages/e6/66/c241c2f8807092ac009f9be1e86364719320355795de2491e65bbe6eb8f9/django_otp_webauthn-0.4.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "049602b37b216240572ce2a44959c525103f5aa8e029fce3b109cc40633f23c3",
"md5": "052b5b6d3665b25c3b3acb248d7308e2",
"sha256": "057c088d08f29d38c52be6cd30be62df9ab143b4c979be1773e76e4ba63ee459"
},
"downloads": -1,
"filename": "django_otp_webauthn-0.4.0.tar.gz",
"has_sig": false,
"md5_digest": "052b5b6d3665b25c3b3acb248d7308e2",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.9",
"size": 128846,
"upload_time": "2024-10-27T18:21:42",
"upload_time_iso_8601": "2024-10-27T18:21:42.014593Z",
"url": "https://files.pythonhosted.org/packages/04/96/02b37b216240572ce2a44959c525103f5aa8e029fce3b109cc40633f23c3/django_otp_webauthn-0.4.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-10-27 18:21:42",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "Stormbase",
"github_project": "django-otp-webauthn",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"tox": true,
"lcname": "django-otp-webauthn"
}
JSON
