Protecting APIs with DeviceCheck, App Attest & WebAuthn
summary
Explains how DeviceCheck App Attest plus WebAuthn produce hardware‑bound keys stored in the secure enclave and how servers use CryptoKit and Vapor to verify CBOR attestation objects and sign future assertions. Describes fetching Apple root certificates, validating a certificate chain, checking a one‑time challenge, detecting key reuse and counting attestations as a fraud signal, and notes Apple’s docs include an incorrect sample challenge. Covers decoding CBOR attestation, following nine validation steps, and integrating via Vapor/CryptoKit.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 0:53The challenge of app security
- 2:35Apple DeviceCheck overview
- 4:05Attestation object structure
- 5:16Validating attestation
- 7:49Assertions for future requests
- 8:15Cross-platform and conclusion
related talks
28mApp Security Essentials
53mHow to Know Your Client Is Real: Hardware-Backed Authentication Patterns
22mShift into high gear: Answering common questions to help you get off the starting line
14mHow to use App Check to protect your custom backend
35mA gentle intro to certification of a cross-platform FIDO2 authenticator
42mBeyond Passwords: How WebAuthn Actually Works
56mPasskeys 101: Technical Principles of FIDO
01h 14mWebAuthn: Theory and practice