AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: webauthn-enterprise-attestation-origin-boundary

WebAuthn Enterprise Attestation and Origin Boundary Enforcement

Mandates strict enterprise hardware attestation, AAGUID allowlisting, and cryptographic origin verification for high-privilege WebAuthn credentials. Prevents multi-device credential synchronization (passkey leaks) across personal consumer clouds by rejecting credentials with active backup eligibility flags during registration.

Prohibited Anti-Pattern: Accepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accounts

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: WebAuthn Enterprise Attestation and Origin Boundary Enforcement - Mandates strict enterprise hardware attestation, AAGUID allowlisting, and cryptographic origin verification for high-privilege WebAuthn credentials. Prevents multi-device credential synchronization (passkey leaks) across personal consumer clouds by rejecting credentials with active backup eligibility flags during registration.
globs: src/auth/**/*.{ts,tsx}, src/server/auth/**/*.{ts,tsx}, api/auth/**/*.{ts,tsx}, services/identity/**/*.{ts,tsx}, packages/auth-core/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/webauthn-enterprise-attestation-origin-boundary"
---

# WebAuthn Enterprise Attestation and Origin Boundary Enforcement

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Accepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accounts

## System Constraints
You are a Principal Security Architect enforcing the WebAuthn Enterprise Attestation Passkey Origin Enforcement Boundary. Your objective is to ensure corporate credentials remain locked to approved hardware security keys (e.g., FIPS YubiKeys) and cannot be synchronized across consumer ecosystems (e.g., iCloud Keychain, Google Password Manager). Enforce zero-trust validation on AAGUIDs, enterprise attestation certificates, backup flags, and exact origin URIs.

## Strict Guidelines
- Engineers MUST ALWAYS demand 'enterprise' or 'direct' attestation in PublicKeyCredentialCreationOptions for privileged roles; never default to 'none'.
- Services MUST verify that authenticatorData flags 'be' (backupEligible) and 'bs' (backupState) are strictly false (0) for corporate credentials to prevent cross-device synchronization.
- Engineers MUST match the extracted Authenticator Attestation Globally Unique Identifier (AAGUID) against a strict corporate hardware allowlist validated via FIDO Metadata Service (MDS3).
- Services MUST enforce exact matching on expected Origin (scheme, fully qualified domain name, and port); regex wildcard origins or dynamic Host-header origin matching are strictly forbidden.
- Components NEVER accept clientDataJSON challenge or origin parameters without cross-referencing against server-side cryptographically signed, single-use session state with TTL <= 120 seconds.
- Code MUST reject credentials where attestation format is 'packed' or 'fido-u2f' without a valid x5c leaf certificate chaining up to a known enterprise intermediate/root authority.

## Bad vs Good Implementations
### Privileged Registration Verification with Enterprise Attestation and Passkey Sync Rejection

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Trusts client-supplied origin, omits enterprise attestation verification, accepts sync-capable passkeys (allowing enterprise credentials to leak into consumer sync keychains), and omits AAGUID validation against hardware security policies.
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';

export async function registerPrivilegedUser(userId: string, body: any, session: any) {
  // INSECURE: Accepts 'none' attestation, ignores sync flags, dynamic origin
  const verification = await verifyRegistrationResponse({
    response: body,
    expectedChallenge: session.currentChallenge,
    expectedOrigin: body.clientDataJSONOrigin, // Vulnerable: trust client origin
    requireUserVerification: false,
  });

  if (verification.verified && verification.registrationInfo) {
    await saveCredential(userId, verification.registrationInfo);
    return { success: true };
  }
  throw new Error('Registration failed');
}
```

#### Production Standard (Correct)
> **Standard**: Enforces deterministic origin and RP ID matching, single-use challenge consumption, explicit rejection of backup-eligible passkeys (preventing consumer cloud syncing), and AAGUID allowlisting restricted to designated corporate hardware tokens.
```typescript
import { verifyRegistrationResponse } from '@simplewebauthn/server';
import type { VerifiedRegistrationResponse } from '@simplewebauthn/server';

// Explicitly approved enterprise hardware AAGUIDs (e.g., FIPS 140-3 Hardware Authenticators)
const APPROVED_ENTERPRISE_AAGUIDS = new Set<string>([
  'ee882879-721c-4916-ad4e-a0604dd67b2d', // YubiKey 5 Series FIPS
  'cb9b2b52-78d6-44eb-b0ea-d8721ad5815a', // YubiKey 5C NFC
]);

const PRODUCTION_ORIGIN = 'https://admin.corp.internal:8443';
const PRODUCTION_RP_ID = 'corp.internal';

export async function registerPrivilegedUser(
  userId: string,
  responseBody: unknown,
  storedSession: { challenge: string; expiresAt: number; markConsumed: () => Promise<void> }
): Promise<VerifiedRegistrationResponse> {
  if (Date.now() > storedSession.expiresAt) {
    throw new Error('Registration challenge expired');
  }

  // Atomically consume challenge to prevent replay attacks
  await storedSession.markConsumed();

  const verification = await verifyRegistrationResponse({
    response: responseBody as any,
    expectedChallenge: storedSession.challenge,
    expectedOrigin: PRODUCTION_ORIGIN,
    expectedRPID: PRODUCTION_RP_ID,
    requireUserVerification: true,
  });

  if (!verification.verified || !verification.registrationInfo) {
    throw new Error('WebAuthn cryptographic verification failed');
  }

  const { aaguid, credentialBackedUp, attestationObject } = verification.registrationInfo;

  // 1. Enforce Non-Syncable Credential Boundary (Reject Multi-Device Synced Passkeys)
  // In @simplewebauthn, credentialBackedUp is derived from the backup flags (be/bs)
  const parsedAuthData = verification.registrationInfo.authenticatorData;
  const flags = parsedAuthData.flags;
  
  if (flags.backupEligible || flags.backupState || credentialBackedUp) {
    throw new Error('Policy violation: Privileged credentials must not be backup-eligible or synchronized');
  }

  // 2. Validate Hardware AAGUID against corporate allowlist
  if (!APPROVED_ENTERPRISE_AAGUIDS.has(aaguid)) {
    throw new Error(`Unauthorized hardware authenticator AAGUID: ${aaguid}`);
  }

  // 3. Ensure attestation type satisfies enterprise or direct hardware trust
  const attType = verification.registrationInfo.attestationObject;
  if (verification.registrationInfo.credentialDeviceType !== 'singleDevice') {
    throw new Error('Policy violation: Only singleDevice credentials permitted');
  }

  return verification;
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

FIDO Alliance MDS3 Inspector
Validates authenticator attestation certificates and AAGUIDs against the live FIDO Alliance Metadata Service (MDS3).
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Smallstep CLI & WebAuthn Validator
Tool for validating X.509 enterprise PKI leaf certificates embedded in WebAuthn attestation trust paths.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Enterprise Attestation and Origin Boundary Enforcement

WebAuthn Enterprise Attestation and Origin Boundary Enforcement defines an industrial-grade behavioral standard for security engineering. Mandates strict enterprise hardware attestation, AAGUID allowlisting, and cryptographic origin verification for high-privilege WebAuthn credentials. Prevents multi-device credential synchronization (passkey leaks) across personal consumer clouds by rejecting credentials with active backup eligibility flags during registration. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accounts Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftAccepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accountsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS demand 'enterprise' or 'direct' attestation in PublicKeyCredentialCreationOptions for privileged roles

Engineers MUST ALWAYS demand 'enterprise' or 'direct' attestation in PublicKeyCredentialCreationOptions for privileged roles; never default to 'none'.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Services MUST verify that authenticatorData flags 'be' (backupEligible) and 'bs' (backupState) are strictly false (0) for corporate credentials to prevent cross-device synchronization.

Services MUST verify that authenticatorData flags 'be' (backupEligible) and 'bs' (backupState) are strictly false (0) for corporate credentials to prevent cross-device synchronization.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST match the extracted Authenticator Attestation Globally Unique Identifier (AAGUID) against a strict corporate hardware allowlist validated via FIDO Metadata Service (MDS3).

Engineers MUST match the extracted Authenticator Attestation Globally Unique Identifier (AAGUID) against a strict corporate hardware allowlist validated via FIDO Metadata Service (MDS3).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST enforce exact matching on expected Origin (scheme, fully qualified domain name, and port)

Services MUST enforce exact matching on expected Origin (scheme, fully qualified domain name, and port); regex wildcard origins or dynamic Host-header origin matching are strictly forbidden.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER accept clientDataJSON challenge or origin parameters without cross-referencing against server-side cryptographically signed, single-use session state with TTL <= 120 seconds.

Components NEVER accept clientDataJSON challenge or origin parameters without cross-referencing against server-side cryptographically signed, single-use session state with TTL <= 120 seconds.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Code MUST reject credentials where attestation format is 'packed' or 'fido-u2f' without a valid x5c leaf certificate chaining up to a known enterprise intermediate/root authority.

Code MUST reject credentials where attestation format is 'packed' or 'fido-u2f' without a valid x5c leaf certificate chaining up to a known enterprise intermediate/root authority.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is WebAuthn Enterprise Attestation and Origin Boundary Enforcement critical for AI coding assistants?

Mandates strict enterprise hardware attestation, AAGUID allowlisting, and cryptographic origin verification for high-privilege WebAuthn credentials. Prevents multi-device credential synchronization (passkey leaks) across personal consumer clouds by rejecting credentials with active backup eligibility flags during registration. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Accepting unverified passkeys with 'none' attestation and permissive backup flags on privileged accounts) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

WebAuthn