Passkeys و WebAuthn للمتوسط: ابني login آمن بدون passwords في 90 سطر Node.js

npm install @simplewebauthn/server@10 @simplewebauthn/browser@10 fastify@4

import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
} from '@simplewebauthn/server';

const rpID = 'haies.app';
const rpName = 'Haies LMS';
const origin = 'https://haies.app';

app.post('/passkey/register/options', async (req, reply) => {
  const user = await db.users.findById(req.body.userId);
  const options = await generateRegistrationOptions({
    rpName,
    rpID,
    userID: Buffer.from(user.id),
    userName: user.email,
    attestationType: 'none',
    authenticatorSelection: {
      residentKey: 'preferred',
      userVerification: 'preferred',
    },
    excludeCredentials: user.passkeys.map(pk => ({ id: pk.credentialID })),
  });
  await db.users.update(user.id, { currentChallenge: options.challenge });
  return options;
});

app.post('/passkey/register/verify', async (req, reply) => {
  const user = await db.users.findById(req.body.userId);
  const verification = await verifyRegistrationResponse({
    response: req.body.attestation,
    expectedChallenge: user.currentChallenge,
    expectedOrigin: origin,
    expectedRPID: rpID,
  });
  if (!verification.verified) {
    return reply.code(400).send({ error: 'invalid_attestation' });
  }
  await db.passkeys.insert({
    userId: user.id,
    credentialID: verification.registrationInfo.credentialID,
    publicKey: verification.registrationInfo.credentialPublicKey,
    counter: verification.registrationInfo.counter,
    deviceType: verification.registrationInfo.credentialDeviceType,
  });
  return { ok: true };
});

<button id="registerBtn">سجّل بـ Passkey</button>
<script type="module">
import { startRegistration } from '@simplewebauthn/browser';

document.getElementById('registerBtn').onclick = async () => {
  const optsRes = await fetch('/passkey/register/options', {
    method: 'POST',
    body: JSON.stringify({ userId: currentUserId }),
    headers: { 'Content-Type': 'application/json' },
  });
  const options = await optsRes.json();
  const attestation = await startRegistration(options);
  await fetch('/passkey/register/verify', {
    method: 'POST',
    body: JSON.stringify({ userId: currentUserId, attestation }),
    headers: { 'Content-Type': 'application/json' },
  });
};
</script>

app.post('/passkey/login/options', async (req, reply) => {
  const options = await generateAuthenticationOptions({
    rpID,
    userVerification: 'preferred',
  });
  await db.sessions.update(req.sessionId, { currentChallenge: options.challenge });
  return options;
});

app.post('/passkey/login/verify', async (req, reply) => {
  const session = await db.sessions.findById(req.sessionId);
  const passkey = await db.passkeys.findByCredentialID(req.body.assertion.id);
  const verification = await verifyAuthenticationResponse({
    response: req.body.assertion,
    expectedChallenge: session.currentChallenge,
    expectedOrigin: origin,
    expectedRPID: rpID,
    credential: {
      id: passkey.credentialID,
      publicKey: passkey.publicKey,
      counter: passkey.counter,
    },
  });
  if (!verification.verified) return reply.code(401).send({ error: 'denied' });
  await db.passkeys.update(passkey.id, { counter: verification.authenticationInfo.newCounter });
  await issueSessionToken(reply, passkey.userId);
  return { ok: true };
});