The End of the Password Era

Over 80% of data breaches involve stolen or compromised passwords. Traditional SMS and TOTP two-factor authentication methods, while an improvement, remain vulnerable to modern adversary-in-the-middle (AitM) phishing proxies.

Passkeys (built on the W3C WebAuthn and FIDO2 standards) replace shared secrets with asymmetric public-key cryptography. The user's private key never leaves their hardware enclave, rendering credential harvesting impossible.

Server-Side Implementation with TypeScript and SimpleWebAuthn

Here is how to implement the verification flow securely using modern Node.js and TypeScript:

import { 
  generateRegistrationOptions, 
  verifyRegistrationResponse
} from '@simplewebauthn/server';

export async function getRegistrationChallenge(user: { id: string; email: string }) {
  const options = await generateRegistrationOptions({
    rpName: 'Meganods Security Mesh',
    rpID: 'meganods.com',
    userID: Buffer.from(user.id),
    userName: user.email,
    attestationType: 'none',
    authenticatorSelection: {
      residentKey: 'required',
      userVerification: 'preferred',
      authenticatorAttachment: 'platform',
    },
  });

  await sessionStore.set(`challenge:${user.id}`, options.challenge, 300);
  return options;
}

export async function verifyPasskeyRegistration(user: { id: string }, body: any) {
  const expectedChallenge = await sessionStore.get(`challenge:${user.id}`);
  
  const verification = await verifyRegistrationResponse({
    response: body,
    expectedChallenge,
    expectedOrigin: 'https://www.meganods.com',
    expectedRPID: 'meganods.com',
  });

  if (verification.verified && verification.registrationInfo) {
    const { credentialPublicKey, credentialID, counter } = verification.registrationInfo;
    await db.passkeys.create({
      userId: user.id,
      credentialId: Buffer.from(credentialID).toString('base64'),
      publicKey: Buffer.from(credentialPublicKey).toString('base64'),
      counter,
    });
    return { success: true };
  }
  throw new Error("Invalid passkey attestation");
}