Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Persisting High-Assurance Sessions Across Authenticator Posture Downgrades and UV Degradation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift

Hardware-backed passkey sessions must maintain continuous device-bound assurance by evaluating authenticatorData flags (User Verification bit 2, User Presence bit 0) during periodic re-assertion and step-up checks. Any observed degradation from the baseline posture established at registration—such as UV downgrade, platform-to-roaming transport divergence, or signature counter anomalies—must trigger immediate session revocation. Failure to evict sessions on signal drift allows session hijacking via credential proxying, biometric bypass, and platform downgrade attacks.

--- description: Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift - Hardware-backed passkey sessions must maintain continuous device-bound assurance by evaluating authenticatorData flags (User Verification bit 2, User Presence bit 0) during periodic re-assertion and step-up checks. Any observed degradation from the baseline posture established at registration—such as UV downgrade, platform-to-roaming transport divergence, or signature counter anomalies—must trigger immediate session revocation. Failure to evict sessions on signal drift allows session hijacking via credential proxying, biometric bypass, and platform downgrade attacks. globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, src/services/session/**/*.{ts,tsx}, lib/auth/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-device-bound-session-eviction-on-attestation-drift" --- # Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting High-Assurance Sessions Across Authenticator Posture Downgrades and UV Degradation ## System Constraints You are a Principal Security Architect enforcing hardware-bound session security under FIDO2/WebAuthn specifications. Mandate continuous authenticator posture verification and instantaneous session eviction upon any attestation or authenticatorData signal drift. ## Strict Guidelines - Engineers MUST ALWAYS verify that the User Verification (UV) flag (bit 2, 0x04) in authenticatorData strictly matches or exceeds the session's recorded baseline requirement. - Engineers MUST NOT allow a session established under a platform authenticator with UV=1 to continue if a re-assertion or step-up presents UV=0. - Services MUST atomically invalidate session tokens, refresh tokens, and cache entries immediately upon detecting authenticator signal drift or signCount regressions. - Code SHOULD extract and validate the authenticatorData raw byte flags using bitwise operations rather than relying exclusively on unverified client-side boolean claims. - Components NEVER issue long-lived hardware-bound claims without tying session validity to monotonic signCount increments and invariant authenticator attachment types. ## Bad vs Good Implementations ### Continuous Posture Evaluation and Signal Drift Eviction #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler only checks if the WebAuthn signature is cryptographically valid. It fails to inspect whether the authenticatorData flags (specifically User Verification) have degraded relative to the baseline requirements established at session creation. If an attacker proxies the credential or bypasses biometric verification down to simple presence, the high-privilege session remains alive. ```typescript import { Request, Response } from 'express'; import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import { sessionStore } from './session'; export async function verifyStepUpAssertion(req: Request, res: Response) { const { sessionId, assertionResponse } = req.body; const session = await sessionStore.get(sessionId); // ANTI-PATTERN: Only checks cryptographic validity of signature; // ignores UV flag degradation and fails to evict session on posture drift const verification = await verifyAuthenticationResponse({ response: assertionResponse, expectedChallenge: session.currentChallenge, expectedOrigin: 'https://example.com', expectedRPID: 'example.com', credential: { id: session.credentialId, publicKey: session.publicKey, counter: session.prevCounter, }, }); if (!verification.verified) { return res.status(401).json({ error: 'Verification failed' }); } // Session retained despite possible drop from biometric UV to unverified presence session.prevCounter = verification.authenticationInfo.newCounter; await sessionStore.save(session); return res.json({ success: true }); } ``` #### Production Standard (Correct) > **Standard**: The solution explicitly inspects raw authenticatorData flags at byte offset 32 to guarantee User Verification (UV) and User Presence (UP) have not regressed. If the session requires hardware UV and the re-assertion lacks the UV flag, or if the monotonic counter fails to increment, the session is atomically evicted from the session store with an explicit audit trail. ```typescript import { Request, Response } from 'express'; import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import { sessionStore, EvictionReason } from './session'; const WEBAUTHN_FLAGS = { UP: 0x01, // Bit 0: User Present UV: 0x04, // Bit 2: User Verified } as const; export async function verifyStepUpAssertion(req: Request, res: Response) { const { sessionId, assertionResponse } = req.body; const session = await sessionStore.get(sessionId); if (!session) { return res.status(401).json({ error: 'Session not found' }); } const verification = await verifyAuthenticationResponse({ response: assertionResponse, expectedChallenge: session.currentChallenge, expectedOrigin: process.env.AUTH_RP_ORIGIN!, expectedRPID: process.env.AUTH_RP_ID!, credential: { id: session.credentialId, publicKey: session.publicKey, counter: session.prevCounter, }, requireUserVerification: session.baselinePolicy.requireUserVerification, }); // Extract flags directly from authenticatorData byte at index 32 const authDataBuffer = Buffer.from(assertionResponse.response.authenticatorData, 'base64url'); const flags = authDataBuffer[32]; const isUserVerified = (flags & WEBAUTHN_FLAGS.UV) !== 0; const isUserPresent = (flags & WEBAUTHN_FLAGS.UP) !== 0; // INVARIANT: If session baseline mandates UV, drift immediately invalidates the entire session const signalDriftDetected = (session.baselinePolicy.requireUserVerification && !isUserVerified) || !isUserPresent || verification.authenticationInfo.newCounter <= session.prevCounter; if (!verification.verified || signalDriftDetected) { await sessionStore.atomicRevokeSession(sessionId, { reason: EvictionReason.AUTHENTICATOR_POSTURE_DRIFT, detectedFlags: { isUserVerified, isUserPresent }, counterDrift: verification.authenticationInfo.newCounter <= session.prevCounter, timestamp: Date.now(), }); return res.status(401).json({ error: 'Session evicted: Security posture degradation detected', code: 'AUTHENTICATOR_SIGNAL_DRIFT', }); } session.prevCounter = verification.authenticationInfo.newCounter; session.lastPostureCheck = Date.now(); await sessionStore.save(session); return res.json({ success: true }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift

Mandatory Session Eviction on WebAuthn Authenticator Data and UV Signal Drift defines an industrial-grade behavioral standard for security engineering. Hardware-backed passkey sessions must maintain continuous device-bound assurance by evaluating authenticatorData flags (User Verification bit 2, User Presence bit 0) during periodic re-assertion and step-up checks. Any observed degradation from the baseline posture established at registration—such as UV downgrade, platform-to-roaming transport divergence, or signature counter anomalies—must trigger immediate session revocation. Failure to evict sessions on signal drift allows session hijacking via credential proxying, biometric bypass, and platform downgrade attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting High-Assurance Sessions Across Authenticator Posture Downgrades and UV Degradation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting High-Assurance Sessions Across Authenticator Posture Downgrades and UV Degradation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify that the User Verification (UV) flag (bit 2, 0x04) in authenticatorData strictly matches or exceeds the session's recorded baseline requirement.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.