webauthn-ruby VS rodauth-model

Rodauth provides first class support for passkeys, implemented on top of the excellent webauthn-ruby gem. It enables using passkeys as a multifactor authentication method, or for passwordless login and registration. In addition to routes, views and database storage, it also provides the complete JavaScript part that interacts with Web Authentication API for zero configuration.

Would it make sense to leverage another gem like https://github.com/cedarcode/webauthn-ruby for this? Or are we thinking a completely devise internal implementation? Either way I’m interested in contributing to this movement for devise

I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby

Luckily, there is a WebAuthn gem for Ruby (thanks!) that will do all the hard work for us. Just run bundle add webauthn.

All OTP-based 2FA methods are phishable. For real security, you should be looking at FIDO (U2F or WebAuthN)

Finally, let's also modify the remove form to display nicknames instead of last used timestamps (we're using the Account#webauthn_keys association defined by rodauth-model):

While I love this decoupling, it would still be nice to be able to at least create accounts and retrieve associations directly through the model. So, I created the rodauth-model gem, which provides an interface similar to Active Record's has_secure_password, and defines associations based on your Rodauth configuration (together with associated models).