Password-less apps: implementing WebAuthN

on YouTube ↗46m

" summary

Live demo adds WebAuthN to a Spring Boot app: JavaScript calls navigator.credentials.create/get, server generates per-session challenge and stores it, the client returns base64 attestation/assertion which the app decodes and saves. Uses WebAuthn4J to validate signatures and attestation bytes, persists credential ID/public key and counter, supports Spring Boot + Spring Security session login and shows Touch ID / YubiKey and phone passkey flows. Demo has a few UI glitches but registration and authentication succeed end-to-end.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to passkeys
2. 2:10Demonstrating passkey use
3. 5:41Key security concepts
4. 7:46Protocol work flow
5. 11:20Setting up the demo app
6. 14:29Implementing registration
7. 22:31Handling backend registration
8. 32:37Implementing authentication
9. 39:03Validating credentials
10. 44:21Conclusion and Q&A

" related talks

• 45mPassword-less apps: implementing WebAuthNJosh Long, Daniel Garnier-Moiroux · Devoxx France 2024
• 40mGoing passwordless with Web AuthenticationBogdan Arvinte, Mihaita Tinta · Voxxed Days Bucharest 2022
• 43mPasskeys in practice: implementing passwordless appsDaniel Garnier-Moiroux · Voxxed Days Ticino 2025
• 45mSecure your application with WebAuthnArnaud Locquet · Devoxx France 2021
• 49mA Passwordless Future! WebAuthn for Java DevelopersDeepu K Sasidharan · J-Fall 2023
• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 31mGetting Started with Passkeys and WebAuthnLucas Castro · UtahJS Conf 2024
• 39mPasswords are so 1990 - Sam Bellen - PHP UK 2022Sam Bellen · PHP UK Conference 2022