FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Stateless FIDO2 Assertion Verification Lacking Synchronous Credential Revocation & Epoch Barriers) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier

--- description: FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier - Enforces real-time cryptographic revocation validation and stateful epoch barrier checks for all FIDO2/WebAuthn authentication assertions. Prevents ghost session creation and unauthorized lateral access originating from orphaned multi-device synced passkeys on deprovisioned, lost, or compromised client devices. globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, src/services/webauthn/**/*.{ts,tsx}, src/controllers/auth/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-assertion-revocation-barrier" --- # FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Stateless FIDO2 Assertion Verification Lacking Synchronous Credential Revocation & Epoch Barriers ## System Constraints You are a Principal Security Architect enforcing zero-trust invariants for FIDO2/WebAuthn passkey authentication. Multi-device synced credentials create a significant attack surface: an exported or synced passkey on an orphaned hardware endpoint can produce cryptographically valid signatures even after an administrative deprovision or session revocation. You must mandate that every WebAuthn assertion verification is atomically bounded to a synchronous IdP revocation registry, challenge session lifetime, and monotonic user security epoch. ## Strict Guidelines - Engineers MUST ALWAYS verify credential active status in the central Identity Provider (IdP) database or Redis revocation cache within the same atomic transaction as cryptographic assertion verification. - Engineers MUST ALWAYS invalidate and delete the authentication challenge immediately upon consumption (one-time use) before signature verification to prevent replay attacks. - Engineers MUST validate the user's global `securityEpoch` against the credential's `issuedEpoch` or last verified state, instantly rejecting assertions for credentials orphaned prior to administrative session revocations. - Engineers MUST NOT trust `signCount` validation alone for multi-device credentials (synced passkeys) since synced authenticators do not synchronize monotonic signature counters across devices. - Services MUST emit a structured audit log and terminate the auth flow if an assertion references a revoked, suspended, or unassigned credential ID. - Components NEVER issue ambient session tokens (JWT, cookies) based purely on mathematical verification of client-provided assertions without explicit real-time identity state synchronization. ## Bad vs Good Implementations ### WebAuthn Assertion Verification with Real-Time Revocation & Epoch Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code blindly verifies the cryptographic signature without checking if the credential has been revoked or orphaned. The challenge is not consumed atomically, leaving room for replay, and no check is made against the user's security epoch or deprovisioning state. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import { getUserCredential, createSessionToken } from './auth-service'; export async function handleAssertion(req, res) { const { credentialId, response, userId } = req.body; const credential = await getUserCredential(userId, credentialId); const expectedChallenge = req.session.challenge; // ANTI-PATTERN: Stateless verification without checking credential revocation, // challenge single-use destruction, or IdP global security epoch. const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: 'https://example.com', expectedRPID: 'example.com', authenticator: { credentialPublicKey: credential.publicKey, credentialID: credential.id, counter: credential.counter, }, }); if (verification.verified) { // Synced passkey on a deprovisioned device still gets a valid session! const token = await createSessionToken(userId); return res.json({ token }); } return res.status(401).json({ error: 'Failed' }); } ``` #### Production Standard (Correct) > **Standard**: Enforces an atomic challenge burn (via GETDEL), checks the credential status and revocation timestamp, and cross-checks against the user's `securityEpoch` before verifying the signature and updating state. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import { db } from '../db'; import { redisClient } from '../cache'; import { SecurityException } from '../errors'; export async function handleAssertion(req, res) { const { credentialId, response, userId } = req.body; const challengeKey = `webauthn:challenge:${userId}`; // 1. Atomically consume and delete the ephemeral challenge const expectedChallenge = await redisClient.getdel(challengeKey); if (!expectedChallenge) { throw new SecurityException('Authentication challenge expired or replayed.'); } // 2. Fetch credential and user state atomically with revocation barrier check const userRecord = await db.user.findUnique({ where: { id: userId }, include: { credentials: { where: { id: credentialId } } }, }); const credential = userRecord?.credentials[0]; if (!userRecord || !credential) { throw new SecurityException('Credential or subject does not exist.'); } // INVARIANT: Validate credential is not revoked and satisfies IdP epoch if (credential.status !== 'ACTIVE' || credential.revokedAt !== null) { throw new SecurityException('Passkey credential has been explicitly revoked.'); } if (credential.epoch < userRecord.securityEpoch) { throw new SecurityException('Credential superseded by global security epoch invalidation.'); } // 3. Cryptographic assertion validation const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: process.env.AUTH_ORIGIN!, expectedRPID: process.env.RP_ID!, authenticator: { credentialPublicKey: credential.publicKey, credentialID: credential.id, counter: credential.counter, }, requireUserVerification: true, }); if (!verification.verified || !verification.authenticationInfo) { throw new SecurityException('Cryptographic assertion verification failed.'); } // 4. Update counter for single-device passkeys or update lastUsed timestamp await db.credential.update({ where: { id: credential.id }, data: { counter: verification.authenticationInfo.newCounter, lastUsedAt: new Date(), }, }); const sessionToken = await issueBoundSession(userRecord.id, credential.id); return res.status(200).json({ sessionToken }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier

FIDO2/WebAuthn Assertion Revocation & Real-Time Ephemeral Epoch Barrier defines an industrial-grade behavioral standard for security engineering. Enforces real-time cryptographic revocation validation and stateful epoch barrier checks for all FIDO2/WebAuthn authentication assertions. Prevents ghost session creation and unauthorized lateral access originating from orphaned multi-device synced passkeys on deprovisioned, lost, or compromised client devices. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Stateless FIDO2 Assertion Verification Lacking Synchronous Credential Revocation & Epoch Barriers Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Stateless FIDO2 Assertion Verification Lacking Synchronous Credential Revocation & Epoch Barriers	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify credential active status in the central Identity Provider (IdP) database or Redis revocation cache within the same atomic transaction as cryptographic assertion verification.

Engineers MUST ALWAYS verify credential active status in the central Identity Provider (IdP) database or Redis revocation cache within the same atomic transaction as cryptographic assertion verification.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.