webauthn4j VS java-webauthn-server

WebAuthn4j: A 100% FIDO2 conformant library with support for all attestation formats and validation. It is used by Keycloak and Spring Security.

After experimenting with https://webauthn.io I was quickly convinced I wanted to implement them also. So I got to work, reading up the specification, and implementing the library - Webauthn4j - github As soon as I got a basic implementation going it dawned on me, how am I going to test this?

Hey all! I'm working on some personal projects and I'm wondering if it's worth to implement WebAuthn into them. I'm mostly looking at the library WebAuthn4J since it also provides a starter for Spring.

Language Stars License Link GO 750+ BSD-3 https://github.com/duo-labs/webauthn Python 380+ BSD-3 https://github.com/duo-labs/py_webauthn Java 200+ Apache-2 https://github.com/webauthn4j/webauthn4j PHP 120+ MIT https://github.com/lbuchs/WebAuthn

java-webauthn-server: A library from Yubico that supports many attestation format. But it is not 100% FIDO2 conformant.

I have some example code here: https://github.com/Yubico/java-webauthn-server/blob/main/webauthn-server-demo/src/main/webapp/index.html

If you need them to use one of a set of trusted authenticator models, then you need attestation. Your authentication servers will need to compile a set of acceptable attestation root certificates, and require that all enrolled credentials have a valid attestation statement that correctly chains to one of those trusted root certificates. Yubico provides libraries to help with this for Python and Java You can provide the devices or let users self-source one on the list of acceptable models. Your webapp will also need to guide users to use the correct authenticator if they attempt to use an untrusted one. Note that this will only let you verify an authenticator model, not individual YubiKeys (i.e., not on serial number level).