Hardware Security Keys — FIDO2 and WebAuthn Hardware Authentication

// WebAuthn registration with hardware key
async function registerHardwareKey() {
  const options = await fetch('/auth/webauthn/register/begin', {
    method: 'POST',
    headers: { Authorization: `Bearer ${accessToken}` }
  }).then(r => r.json());

  options.publicKey.challenge = base64url.decode(options.publicKey.challenge);
  options.publicKey.user.id = base64url.decode(options.publicKey.user.id);
  options.publicKey.excludeCredentials = options.publicKey.excludeCredentials?.map(c => ({
    ...c,
    id: base64url.decode(c.id)
  }));

  const credential = await navigator.credentials.create({ publicKey: options.publicKey });

  await fetch('/auth/webauthn/register/complete', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      id: credential.id,
      rawId: base64url(credential.rawId),
      type: credential.type,
      response: {
        clientDataJSON: base64url(credential.response.clientDataJSON),
        attestationObject: base64url(credential.response.attestationObject),
        transports: credential.response.getTransports?.()
      }
    })
  });
}

// Authentication with hardware key
async function authenticateWithKey() {
  const options = await fetch('/auth/webauthn/login/begin').then(r => r.json());

  options.publicKey.challenge = base64url.decode(options.publicKey.challenge);
  options.publicKey.allowCredentials = options.publicKey.allowCredentials?.map(c => ({
    ...c,
    id: base64url.decode(c.id)
  }));

  const assertion = await navigator.credentials.get({ publicKey: options.publicKey });

  const response = await fetch('/auth/webauthn/login/complete', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      id: assertion.id,
      rawId: base64url(assertion.rawId),
      type: assertion.type,
      response: {
        authenticatorData: base64url(assertion.response.authenticatorData),
        clientDataJSON: base64url(assertion.response.clientDataJSON),
        signature: base64url(assertion.response.signature),
        userHandle: base64url(assertion.response.userHandle)
      }
    })
  });

  const { token } = await response.json();
  return token;
}