glasslock

Server-side WebAuthn/FIDO2 credential verification for Gleam.

Covers both registration and authentication ceremonies, generating challenge options for the browser and verifying the signed responses. Designed for use with glasskey on the browser side, or any client that produces the same JSON format (e.g. @simplewebauthn/browser).

Installation

gleam add glasslock

Usage

glasslock/registration builds registration options and verifies registration responses. glasslock/authentication builds authentication options and verifies assertions for known-user and discoverable flows.

Both builders return #(options_json, challenge). Send options_json to the browser and retain challenge until the response arrives. Keep the challenge in memory on one node. To move it between processes or nodes, use the module’s encode_challenge and parse_challenge functions.

After registration, insert the returned credential only if its ID is unassigned. After authentication, persist the returned sign_count. For discoverable credentials, use parse_response_json and response_info to load the account and stored credential, then pass the same parsed response to verify.

Storing Credentials

Each user can register multiple passkeys. After registration, store per passkey:

Field	Source
`credential_id`	`credential.id`
`public_key`	`glasslock.encode_public_key(credential.public_key)`. Rehydrate with `glasslock.parse_public_key` before calling `verify`.
`sign_count`	`credential.sign_count`. Update after each authentication.
`transports`	`credential.transports`. Pass back to `registration.exclude_credential` and `authentication.allow_credential` so the browser can route requests.

The credential ID must be unique across every account for the RP. Enforce this with a database uniqueness constraint: UNIQUE (credential_id) for one RP, or UNIQUE (rp_id, credential_id) when a database serves several RPs.