Meteor Login using WebAuthn API

[wreiske]

I’d like to have my team work on this. Checking here for feedback before we start work.

Seeking Community Input: WebAuthn Integration for Meteor

We are preparing to implement WebAuthn support for two Meteor-based projects, ozwell.ai and BlueHive. Our goal is to contribute this back to the community and ensure it’s beneficial for everyone. Before starting, I’d love your input: Would the community prefer WebAuthn integration into the existing core accounts-2fa package, or should we create a standalone package (e.g., bluehive:accounts-webauthn)? Your thoughts and advice are greatly appreciated! Looking forward to collaborating and making…

[dr.dimitru]

I’d run a poll. Voting for bluehive:accounts-webauthn

[paulishca]

WebAuthn can be used to authenticate anything with biometrics, it is not only for accounts authentication. For example, write a message and authenticate the sending with biometrics. Yeah … it is really me who sends it.

It works differently for different platforms. On a desktop the user would probably create a passord if the computer doesn’t have a biometric system installed. On Android you need something to store the local key. My Samsung phone uses the Google service to store the local key, but it is a bit confusing. In the image, that is not a field to write something in. On IOS the experience is less cumbersome.

[dr.dimitru]

@paulishca good point
@wreiske then we will need two packages:

• webauthn
• and accounts-webauthn based on webauthn

Or perhaps there’s NPM WebAuthn package that we can use as base?

[wreiske]

I have a working webauthn example I wrote about 3 years ago that utilized GitHub - MasterKale/SimpleWebAuthn: WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.

It includes two dependencies:

• @simplewebauthn/server - docs: @simplewebauthn/server

• @simplewebauthn/browser - docs: @simplewebauthn/browser

This code is from 2022 and could use some dusting off. There may not be a need for simplewebauthn if browsers have updated support recently / are more standard in how they handle passkeys and other auth.

I just tested it and was successful in setting it up, so it may still be promising.

[italojs]

Would be nice we have an blog post about Meteor Login using WebAuthn API

[rjdavid]

@paulishca

My Samsung phone uses the Google service to store the local key, but it is a bit confusing. In the image, that is not a field to write something in.

The app can pass that info when initiating the creation of the credentials.

Samsung phone below

[rjdavid]

@wreiske

There may not be a need for simplewebauthn if browsers have updated support recently / are more standard in how they handle passkeys and other auth.

There are a lot of browser quirks that you will need to keep track of. Better to leave that tracking/handling to a package specifically focusing on webauthn. Then you can focus with meteor-specific implementation.

E.g.
ios had a gesture requirement to initiate the requests (you cannot initiate the requests outside of the scope of non-gesture events). I think it was removed from the newer versions.