Securing Your Application with Passkeys and cbSecurity

Discover Passkeys, the next evolution in secure login methods that eliminate traditional password vulnerabilities. Learn about the CBSecurity Passkeys module's installation, configuration, and integration into your application to enhance security.

4. https://slides.com/elpete/itb2024-cbsecurity-passkeys

5. Competition
Who has the most Passkeys?
https://support.google.com/chrome/answer/13168025?hl=en&co=GENIE.Platform%3DDesktop&oco=1
 https://support.apple.com/en-us/HT211146
https://blog.1password.com/how-save-manage-share-passkeys-1password/

6. What this talk is
An intro to passkeys and passwordless
authentication
Overview of the CBSecurity Passkeys
module
Demo of integrating passkeys into a
new ColdBox application

7. What this talk isn't
Introduction to CBSecurity
Deep Dive of all Passkeys options
Framework-agnostic (requires
CBSecurity and ColdBox)

9. Authentication

10. Username and Password
Single-use Links (Email login)
Two Factor Authentication
Security Keys or Cards
Authentication

11. The Problems
with Passwords

12. Source: The United States of P@ssw0rd$

13. Source: The United States of P@ssw0rd$

14. Source: The United States of P@ssw0rd$

15. Source: The United States of P@ssw0rd$ https://haveibeenpwned.com

17. So what's the
solution?

18. Password Rules?

19. https://neal.fun/password-game/

20. Password Manager?

21. Source: Password Manager Industry Report and Market Outlook (2023-2024)

22. Source: Password Manager Industry Report and Market Outlook (2023-2024)
Source:  (2019)The United States of P@ssw0rd$

23. Friction

24. Phishing

25. https://www.youtube.com/embed/u9dBGWVwMMA?si=6nSS-
4IwJBUz8Syo&clip=UgkxMBp_WBB9p6-
WqubtH0RSvSVbNCkIYULY&clipt=EMi7DhiokBI&enablejsapi=1

26. How do Passkeys
solve the problems
with Passwords?

27. No passwords to remember
Unique passkey per site
Two-factor by default
Cannot be phished
Built on Public / Private key pairs
Benefits of Passkeys

28. Webauthn
https://webauthn.guide/
https://webauthn.io/
MDN: Web Authentication API

29. Passkeys
https://passkeys.dev/
https://fidoalliance.org/passkeys/

30. Webauthn Passkeys==
Webauthn Passkeys!==
Techincal Name Marketing

31. Adoption
“
In less than a year, passkeys have been used
to authenticate people more than 1 billion times
across over 400 million Google Accounts.
Passkeys, Cross-Account Protection and new ways we’re protecting your accounts

32. Paid Solutions
Auth0
Passage
Passwordless.dev

33. The "Ortus Solutions"

34. CBSecurity Passkeys
SUPER COOL LOGO
COMING SOON!

35. CBSecurity Passkeys
Builds on CBSecurity and CBAuth
Uses your Authentication Provider to log users in
Requires CBSecurity 3+ and CBAuth 6.1+
Built on top of  by webauthn-server-coreYubico

36. CBSecurity Passkeys
All required Java dependencies in a single jar
Handlers for registering new Passkeys and
authenticating using Passkeys
JavaScript resources for registering new Passkeys
and authenticating using Passkeys
Required interface for storing and retrieving
Passkeys from an external store (e.g. database)
Provides:

37. Installation

38. box install cbsecurity-passkeys

39. component {


this.javaSettings = {
loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],
loadColdFusionClassPath : true,
reloadOnChange : false
};

}1 2 3 4 5 6 7 8 9 10
Load Java
Dependencies

40. component {


this.javaSettings = {
loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],
loadColdFusionClassPath : true,
reloadOnChange : false
};

}1 2 3 4 5 6 7 8 9 10
this.javaSettings = {component {1 2 3 4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 loadColdFusionClassPath : true,6 reloadOnChange : false7 };8 9 }10
Load Java
Dependencies

41. component {


this.javaSettings = {
loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],
loadColdFusionClassPath : true,
reloadOnChange : false
};

}1 2 3 4 5 6 7 8 9 10
this.javaSettings = {component {1 2 3 4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 loadColdFusionClassPath : true,6 reloadOnChange : false7 };8 9 }10 loadColdFusionClassPath : true,
reloadOnChange : false
};component {1 2 3 this.javaSettings = {4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 6 7 8 9 }10
Load Java
Dependencies

42. component {


this.javaSettings = {
loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],
loadColdFusionClassPath : true,
reloadOnChange : false
};

}1 2 3 4 5 6 7 8 9 10
this.javaSettings = {component {1 2 3 4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 loadColdFusionClassPath : true,6 reloadOnChange : false7 };8 9 }10 loadColdFusionClassPath : true,
reloadOnChange : false
};component {1 2 3 this.javaSettings = {4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 6 7 8 9 }10 }component {1 2 3 this.javaSettings = {4 loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],5 loadColdFusionClassPath : true,6 reloadOnChange : false7 };8 9 10
Load Java
Dependencies

43. schema.create( "cbsecurity_passkeys" , ( t ) => {
t.increments( "id" );
t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );
t.raw( "publicKey BLOB" );
t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );
t.raw( "attestationObject BLOB" );
t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );1 2 3 4 5 6 7 8 9 10 11 12
(OPTIONAL)
Migrate Database Table

44. schema.create( "cbsecurity_passkeys" , ( t ) => {
t.increments( "id" );
t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );
t.raw( "publicKey BLOB" );
t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );
t.raw( "attestationObject BLOB" );
t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );1 2 3 4 5 6 7 8 9 10 11 12 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 3 4 t.raw( "publicKey BLOB" );5 t.unsignedInteger( "signCount" );6 t.bit( "backupEligible" );7 t.bit( "backupState" );8 t.raw( "attestationObject BLOB" );9 t.text( "clientDataJSON" );10 t.datetime( "lastUsedTimestamp" ).nullable();11 } );12
(OPTIONAL)
Migrate Database Table

45. schema.create( "cbsecurity_passkeys" , ( t ) => {
t.increments( "id" );
t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );
t.raw( "publicKey BLOB" );
t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );
t.raw( "attestationObject BLOB" );
t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );1 2 3 4 5 6 7 8 9 10 11 12 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 3 4 t.raw( "publicKey BLOB" );5 t.unsignedInteger( "signCount" );6 t.bit( "backupEligible" );7 t.bit( "backupState" );8 t.raw( "attestationObject BLOB" );9 t.text( "clientDataJSON" );10 t.datetime( "lastUsedTimestamp" ).nullable();11 } );12 t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );3 t.raw( "credentialId BLOB" );4 t.raw( "publicKey BLOB" );5 6 7 8 t.raw( "attestationObject BLOB" );9 t.text( "clientDataJSON" );10 t.datetime( "lastUsedTimestamp" ).nullable();11 } );12
(OPTIONAL)
Migrate Database Table

46. schema.create( "cbsecurity_passkeys" , ( t ) => {
t.increments( "id" );
t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );
t.raw( "publicKey BLOB" );
t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );
t.raw( "attestationObject BLOB" );
t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );1 2 3 4 5 6 7 8 9 10 11 12 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 3 4 t.raw( "publicKey BLOB" );5 t.unsignedInteger( "signCount" );6 t.bit( "backupEligible" );7 t.bit( "backupState" );8 t.raw( "attestationObject BLOB" );9 t.text( "clientDataJSON" );10 t.datetime( "lastUsedTimestamp" ).nullable();11 } );12 t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );3 t.raw( "credentialId BLOB" );4 t.raw( "publicKey BLOB" );5 6 7 8 t.raw( "attestationObject BLOB" );9 t.text( "clientDataJSON" );10 t.datetime( "lastUsedTimestamp" ).nullable();11 } );12 t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );schema.create( "cbsecurity_passkeys" , ( t ) => {1 t.increments( "id" );2 t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );3 t.raw( "credentialId BLOB" );4 t.raw( "publicKey BLOB" );5 t.unsignedInteger( "signCount" );6 t.bit( "backupEligible" );7 t.bit( "backupState" );8 t.raw( "attestationObject BLOB" );9 10 11 12
(OPTIONAL)
Migrate Database Table

47. Configuration

48. Module Settings

49. moduleSettings = {
"cbsecurity-passkeys" : {
// WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",

// The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)
"relyingPartyName" : controller.getSetting( "appName" ),

// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.
// (Non-standard ports need to be specified explicitly)
"allowedOrigins": []
}
};1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

50. moduleSettings = {
"cbsecurity-passkeys" : {
// WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",

// The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)
"relyingPartyName" : controller.getSetting( "appName" ),

// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.
// (Non-standard ports need to be specified explicitly)
"allowedOrigins": []
}
};1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 // WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",moduleSettings = {1 "cbsecurity-passkeys" : {2 3 4 5 6 // The identifier for the relying party (your application)7 "relyingPartyId" : CGI.SERVER_NAME,8 9 // The display name for the relying party (your application)10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 // The allowed origins to send you Passkeys.13 // Defaults to the server name, if empty.14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18

51. moduleSettings = {
"cbsecurity-passkeys" : {
// WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",

// The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)
"relyingPartyName" : controller.getSetting( "appName" ),

// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.
// (Non-standard ports need to be specified explicitly)
"allowedOrigins": []
}
};1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 // WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",moduleSettings = {1 "cbsecurity-passkeys" : {2 3 4 5 6 // The identifier for the relying party (your application)7 "relyingPartyId" : CGI.SERVER_NAME,8 9 // The display name for the relying party (your application)10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 // The allowed origins to send you Passkeys.13 // Defaults to the server name, if empty.14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18 // The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)moduleSettings = {1 "cbsecurity-passkeys" : {2 // WireBox mapping to the component3 // implementing the ICredentialRepository interface4 "credentialRepositoryMapping" : "",5 6 7 8 9 10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 // The allowed origins to send you Passkeys.13 // Defaults to the server name, if empty.14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18

52. moduleSettings = {
"cbsecurity-passkeys" : {
// WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",

// The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)
"relyingPartyName" : controller.getSetting( "appName" ),

// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.
// (Non-standard ports need to be specified explicitly)
"allowedOrigins": []
}
};1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 // WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping" : "",moduleSettings = {1 "cbsecurity-passkeys" : {2 3 4 5 6 // The identifier for the relying party (your application)7 "relyingPartyId" : CGI.SERVER_NAME,8 9 // The display name for the relying party (your application)10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 // The allowed origins to send you Passkeys.13 // Defaults to the server name, if empty.14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18 // The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,

// The display name for the relying party (your application)moduleSettings = {1 "cbsecurity-passkeys" : {2 // WireBox mapping to the component3 // implementing the ICredentialRepository interface4 "credentialRepositoryMapping" : "",5 6 7 8 9 10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 // The allowed origins to send you Passkeys.13 // Defaults to the server name, if empty.14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18
// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.moduleSettings = {1 "cbsecurity-passkeys" : {2 // WireBox mapping to the component3 // implementing the ICredentialRepository interface4 "credentialRepositoryMapping" : "",5 6 // The identifier for the relying party (your application)7 "relyingPartyId" : CGI.SERVER_NAME,8 9 // The display name for the relying party (your application)10 "relyingPartyName" : controller.getSetting( "appName" ),11 12 13 14 // (Non-standard ports need to be specified explicitly)15 "allowedOrigins": []16 }17 };18

53. ICredentialRepository

54. ICredentialRepository
Defines the methods needed to
register and authenticate Passkeys
An example implementation using
Quick is available in the module.
resources/examples/Passkey.cfc

55. ICredentialRepository
public string function getUsernameForUser( required any user ) {}

public string function getDisplayNameForUser ( required any user ) {}

public any function getUserHandleForUser ( required any user ) {}

public array function getCredentialIdsForUsername ( required string username ) {}

public any function getUserHandleForUsername ( required string username ) {}

public string function getUsernameForUserHandle ( required any userHandle ) {}

public struct function lookup( required any credentialId, required any userHandle ) {}

public array function lookupAll( required any credentialId ) {}

public void function storeCredentialForUser ( /* ... */ ) {}

public void function updateCredentialForUser ( /* ... */ ) {}1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

56. Usage

57. Server-side

58. Implement
ICredentialRepository

59. Client-side

60. Detecting Passkey Support
<cfoutput>
<div>
<div class="jumbotron mt-sm-5 p-4" >
<h1>Passkey Demo</h1>
</div>
<form id="passkey-form" action="#event.buildLink( " passkeys.new" )#" method=
<button type="submit" class="btn btn-primary">Create Passkey</button>
</form>
</div>
</cfoutput>

<script src="/modules_app/cbsecurity-passkeys/includes/js/passkeys.js" ></script>
<script>
if (window.cbSecurity.passkeys.isSupported()) {
document.getElementById("passkey-form").style.display = "block";
}
</script>1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

61. Registering Passkeys
<cfoutput>
<div>
<div class="jumbotron mt-sm-5 p-4" >
<h1>Creating a Passkey... </h1>
</div>
</div>
<script src="/modules/cbsecurity-passkeys/includes/passkeys.js" ></script>
<script>
window.cbSecurity.passkeys.register();
</script>
</cfoutput>1 2 3 4 5 6 7 8 9 10 11

62. Logging in with a Passkey
<cfoutput>
<h3>Log In</h3>
<small>or <a href="#event.buildLink( " registrations.new" )#">register for an account </a></small>
<hr />
<form id="loginForm" method="POST" action="#event.buildLink( " login" )#">
<input type="hidden" name="_token" value="#csrfGenerateToken()#" />
<div class="form-group">
<label for="username">Email Address:</label>
<input name="email" type="text" class="form-control" id="email" autocomplete="username webauthn" />
</div>
<div class="form-group">
<label for="password">Password:</label>
<input name="password" type="password" class="form-control" id="password" autocomplete="current-password webauthn" />
</div>
<div class="form-group">
<button type="submit" class="btn btn-primary">Log In</button>
</div>
</form>
<button id="passkeyLoginButton" type="button" class="btn btn-primary" style="display: none;">Log in with Passkey</button>
</cfoutput>

<script src="/modules_app/cbsecurity-passkeys/includes/passkeys.js" ></script>
<script>
if ( window.cbSecurity.passkeys.isSupported() ) {
const passkeyLoginButton = document.getElementById( "passkeyLoginButton" );
passkeyLoginButton.style.display = "block";
passkeyLoginButton.addEventListener( "click", function() {
window.cbSecurity.passkeys.login( document.forms.loginForm.email.value);
});
}
</script>1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

63. Demo

65. Competition
Results
So who has the most Passkeys?