WebAuthn Conditional UI Authenticator Binding Attestation Standard

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Ambient Passkey Autofill Without Cryptographic Device Session Nonce Binding and UV Enforcement) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

WebAuthn Conditional UI Authenticator Binding Attestation Standard

--- description: WebAuthn Conditional UI Authenticator Binding Attestation Standard - Mandates cryptographic binding of WebAuthn Conditional UI assertions to origin-scoped, ephemeral device trust sessions. Prevents cross-context assertion replay, credential relaying, and passkey autofill session fixation by enforcing strictly consumed nonces, exact origin validation, and mandatory user verification. globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, pages/api/auth/**/*.{ts,tsx}, app/api/auth/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-conditional-ui-binding-attestation" --- # WebAuthn Conditional UI Authenticator Binding Attestation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Passkey Autofill Without Cryptographic Device Session Nonce Binding and UV Enforcement ## System Constraints You are a Principal Security Architect enforcing the WebAuthn Conditional UI Authenticator Binding Attestation Standard. You must mandate that every WebAuthn Conditional Mediation ('conditional' UI) request is cryptographically tied to an origin-bound, ephemeral device session. Prevent ambient replay attacks by ensuring assertion challenges are single-use, strictly bound to client TLS/session identifiers, verified against userVerification requirements, and validated with monotonic signature counter audits. ## Strict Guidelines - Engineers MUST ALWAYS generate cryptographically secure, high-entropy challenges bound directly to an ephemeral, HttpOnly, SameSite=Strict pre-auth session cookie prior to invoking navigator.credentials.get with mediation: 'conditional'. - Engineers MUST NOT accept shared, static, or globally cached WebAuthn challenges across multiple unauthenticated browser sessions or devices. - Code SHOULD enforce userVerification: 'required' in PublicKeyCredentialRequestOptions to guarantee explicit biometric or PIN authorization during ambient autofill flows. - Services MUST atomically invalidate the challenge nonce upon the initial verification attempt, regardless of whether the assertion verification succeeds or fails. - Components NEVER accept assertion credentials without strictly verifying clientDataJSON origin (must match expected origin exactly, no wildcard subdomains), rpId, and verifying that the signature counter (signCount) is strictly greater than the recorded baseline. ## Bad vs Good Implementations ### Conditional UI Assertion Handling & Server-Side Device Binding #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example pulls an unbound global challenge from Redis, accepts arbitrary origins via the request header, disables mandatory User Verification (`requireUserVerification: false`), and fails to invalidate the challenge atomically. This leaves ambient passkey autofill vulnerable to credential relay, session fixation, and hybrid replay attacks. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import type { AuthenticationResponseJSON } from '@simplewebauthn/types'; import type { Request, Response } from 'express'; // ANTI-PATTERN: Unbound challenge stored in an insecure cache or global state. // Accepts assertion without verifying device binding, allows cross-origin or reused challenges. export async function handleConditionalAssertion(req: Request, res: Response) { const assertion: AuthenticationResponseJSON = req.body; // Flaw 1: Global/ambient challenge retrieved without device/session binding const expectedChallenge = await redisClient.get('latest_global_webauthn_challenge'); const verification = await verifyAuthenticationResponse({ response: assertion, expectedChallenge: expectedChallenge!, expectedOrigin: req.headers.origin || 'http://localhost:3000', expectedRPID: 'example.com', requireUserVerification: false, // Flaw 2: UV disabled, susceptible to ambient autofill hijack }); if (verification.verified) { // Flaw 3: Challenge not invalidated immediately on read/use return res.json({ status: 'ok', userId: verification.authenticationInfo.credentialID }); } return res.status(401).json({ error: 'Failed' }); } ``` #### Production Standard (Correct) > **Standard**: The good example binds the challenge to a device session stored in a `__Host-` prefixed signed cookie, atomically consumes the challenge with `getDel` to prevent replays, enforces strict origin matching against a constant, mandates user verification (`requireUserVerification: true`), and validates monotonic counter increments to detect cloned authenticators. ```typescript import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import type { AuthenticationResponseJSON } from '@simplewebauthn/types'; import type { Request, Response } from 'express'; import { timingSafeEqual } from 'node:crypto'; const EXPECTED_ORIGIN = 'https://auth.example.com'; const EXPECTED_RPID = 'example.com'; export async function handleConditionalAssertion(req: Request, res: Response) { const assertion: AuthenticationResponseJSON = req.body; // Invariant 1: Session-bound device trust token from cryptographically secure cookie const deviceSessionId = req.signedCookies['__Host-auth-device-session']; if (!deviceSessionId) { return res.status(401).json({ error: 'Missing device trust session' }); } // Invariant 2: Atomically pop and invalidate the ephemeral challenge bound to this session const challengeKey = `webauthn:challenge:${deviceSessionId}`; const expectedChallenge = await redisClient.getDel(challengeKey); if (!expectedChallenge) { return res.status(401).json({ error: 'Challenge expired or already consumed' }); } // Invariant 3: Retrieve authenticating credential & stored signCount const authenticator = await db.authenticators.findUnique({ where: { credentialId: assertion.id }, }); if (!authenticator) { return res.status(404).json({ error: 'Unregistered passkey credential' }); } const verification = await verifyAuthenticationResponse({ response: assertion, expectedChallenge, expectedOrigin: EXPECTED_ORIGIN, expectedRPID: EXPECTED_RPID, authenticator: { credentialID: authenticator.credentialId, credentialPublicKey: authenticator.publicKey, counter: authenticator.counter, }, requireUserVerification: true, }); if (!verification.verified) { return res.status(401).json({ error: 'Cryptographic assertion verification failed' }); } // Invariant 4: Detect authenticator cloning or replay via monotonic counter const newCounter = verification.authenticationInfo.newCounter; if (authenticator.counter > 0 && newCounter <= authenticator.counter) { await securityAudit.alertClonedAuthenticator(authenticator.userId, authenticator.credentialId); return res.status(403).json({ error: 'Authenticator counter rollback detected' }); } await db.authenticators.update({ where: { credentialId: assertion.id }, data: { counter: newCounter, lastUsedAt: new Date() }, }); return res.json({ status: 'ok', userId: authenticator.userId }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Conditional UI Authenticator Binding Attestation Standard

WebAuthn Conditional UI Authenticator Binding Attestation Standard defines an industrial-grade behavioral standard for security engineering. Mandates cryptographic binding of WebAuthn Conditional UI assertions to origin-scoped, ephemeral device trust sessions. Prevents cross-context assertion replay, credential relaying, and passkey autofill session fixation by enforcing strictly consumed nonces, exact origin validation, and mandatory user verification. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Passkey Autofill Without Cryptographic Device Session Nonce Binding and UV Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Passkey Autofill Without Cryptographic Device Session Nonce Binding and UV Enforcement	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS generate cryptographically secure, high-entropy challenges bound directly to an ephemeral, HttpOnly, SameSite=Strict pre-auth session cookie prior to invoking navigator.credentials.get with mediation

Engineers MUST ALWAYS generate cryptographically secure, high-entropy challenges bound directly to an ephemeral, HttpOnly, SameSite=Strict pre-auth session cookie prior to invoking navigator.credentials.get with mediation: 'conditional'.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.