WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard

--- description: WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard - Mandates strict canonical RP origin binding, atomic challenge consumption, and multi-device synced credential flags verification (UP/UV/BE/BS) for WebAuthn passkey authentication. Enforces zero-trust cryptographic validation across multi-device enterprise cloud synchronizations to eliminate challenge replay attacks and origin spoofing. globs: src/auth/**/*.ts, src/security/**/*.ts, api/auth/**/*.ts, services/auth/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-dual-attestation-synced-credentials" --- # WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Accepting Unpinned Origins, Client-Provided Nonces, or Unverified Synced Credential Backup States ## System Constraints You are a Principal Security Architect enforcing the WebAuthn Passkey Dual-Attestation & Synced Credential Standard. You must strictly enforce server-side cryptographic verification of WebAuthn assertions and attestation statements. Prevent any design where challenges are verified without atomic single-use invalidation, where origin matching uses loose substring or regex evaluations, or where multi-device sync states (Backup Eligibility 'BE' and Backup State 'BS' flags) bypass enterprise step-up verification. ## Strict Guidelines - Engineers MUST ALWAYS verify relying party origins against an immutable canonical whitelist matching exact scheme, host, and port. - Engineers MUST ALWAYS invalidate and delete authentication challenges atomically in a single transactional step prior to signature verification to prevent replay race conditions. - Engineers MUST NOT permit client-supplied challenge echoes; challenges MUST be retrieved exclusively from secure, authenticated server-side sessions or state stores. - Services MUST inspect authenticator flags (User Presence 'UP', User Verification 'UV', Backup Eligibility 'BE', and Backup State 'BS') and enforce enterprise policy invariants when synced multi-device credentials are detected. - Components NEVER accept parsed clientDataJSON without validating that `type` matches the expected ceremony (`webauthn.get` or `webauthn.create`) and that cryptographic hash bindings match the signature payload. ## Bad vs Good Implementations ### Passkey Assertion Verification with Atomic Challenge Invalidation and Flag Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Vulnerable to challenge replay and origin spoofing: Challenge is read from client payload instead of secure server storage, origin is checked via non-strict substring matching (`.includes`), challenge is not invalidated atomically before verification, and authenticator flags (UV/BE/BS) are ignored. ```typescript import { Request, Response } from 'express'; import { verifyAuthenticationResponse } from '@simplewebauthn/server'; export async function verifyPasskeyAuth(req: Request, res: Response) { const { response, expectedChallenge, origin } = req.body; // CRITICAL SECURITY FLAW: Permitting client-supplied expectedChallenge and unvalidated origin if (origin.includes('example.com')) { const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: origin, expectedRPID: 'example.com', authenticator: { credentialPublicKey: Buffer.from('mock'), counter: 0, credentialID: Buffer.from('mock') }, }); if (verification.verified) { return res.json({ success: true }); } } return res.status(400).json({ error: 'Auth failed' }); } ``` #### Production Standard (Correct) > **Standard**: Implements zero-trust WebAuthn validation: Enforces atomic Redis GETDEL challenge invalidation, pins exact origin and RP ID constants, requires UV (User Verification), and inspects BE/BS flags to prevent unauthorized multi-device cloud credential syncs. ```typescript import { Request, Response } from 'express'; import { verifyAuthenticationResponse } from '@simplewebauthn/server'; import { redisClient } from '../lib/redis'; import { getCredentialFromDB } from '../lib/db'; const CANONICAL_RP_ID = 'auth.enterprise.internal'; const CANONICAL_ORIGIN = 'https://auth.enterprise.internal'; export async function verifyPasskeyAuth(req: Request, res: Response) { const sessionToken = req.cookies['__Host-auth-session']; if (!sessionToken) return res.status(401).json({ error: 'Unauthorized' }); const challengeKey = `webauthn:challenge:${sessionToken}`; // INVARIANT: Atomic challenge retrieval and deletion to eliminate race-window replay attacks const expectedChallenge = await redisClient.getdel(challengeKey); if (!expectedChallenge) { return res.status(400).json({ error: 'Invalid or expired authentication challenge' }); } const { response } = req.body; const credential = await getCredentialFromDB(response.id); if (!credential) { return res.status(404).json({ error: 'Credential not registered' }); } const verification = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin: CANONICAL_ORIGIN, expectedRPID: CANONICAL_RP_ID, authenticator: { credentialPublicKey: credential.publicKey, counter: credential.counter, credentialID: credential.id, }, requireUserVerification: true, }); if (!verification.verified || !verification.authenticationInfo) { return res.status(400).json({ error: 'Cryptographic assertion verification failed' }); } const { userVerified, backupState, backupEligible } = verification.authenticationInfo; // INVARIANT: Enterprise compliance verification for multi-device synced credentials (Passkeys) if (!userVerified) { return res.status(403).json({ error: 'User verification (UV) is mandatory for enterprise access' }); } if (backupEligible && backupState && !credential.allowSyncedCloudCredential) { return res.status(403).json({ error: 'Enterprise policy rejects unmanaged multi-device cloud passkeys' }); } return res.json({ success: true }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard

WebAuthn Dual-Attestation Origin Binding and Replay Prevention Standard defines an industrial-grade behavioral standard for security engineering. Mandates strict canonical RP origin binding, atomic challenge consumption, and multi-device synced credential flags verification (UP/UV/BE/BS) for WebAuthn passkey authentication. Enforces zero-trust cryptographic validation across multi-device enterprise cloud synchronizations to eliminate challenge replay attacks and origin spoofing. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting Unpinned Origins, Client-Provided Nonces, or Unverified Synced Credential Backup States Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Accepting Unpinned Origins, Client-Provided Nonces, or Unverified Synced Credential Backup States	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify relying party origins against an immutable canonical whitelist matching exact scheme, host, and port.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.