From e5880c97a3b6f91deafeeac4ebd4ff52ffcae8c0 Mon Sep 17 00:00:00 2001 From: Italo Date: Thu, 30 Jun 2022 20:08:12 -0400 Subject: [PATCH] Minor clarifications [skip ci] --- README.md | 98 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 77 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index a967843..3f72a87 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ Authenticate users with fingerprints, patterns and biometric data. ```php +// App\Http\Controllers\LoginController.php use Laragear\WebAuthn\Http\Requests\AssertedRequest; public function login(AssertedRequest $request) @@ -45,9 +46,9 @@ composer require laragear/webauthn WebAuthn authentication process consists in two _ceremonies_: attestation, and assertion. -Attestation is the process of asking the authenticator (a phone, laptop, USB key...) to create a private-public key pair, and **register** the public key inside the app. For that to work, the user must exist, and the browser must support WebAuthn, which is what intermediates between the authenticator and the app. +Attestation is the process of asking the authenticator (a phone, laptop, USB key...) to create a private-public key pair, and **register** the public key inside the app. For that to work, the user must exist, and the browser must support WebAuthn, which is what intermediates between the authenticator (OS & device hardware) and the app. -Assertion is the process of pushing a cryptographic challenge to the device, which will return _signed_ by the private key. Upon arrival, the app checks the signature with the public key, ready to **log in**. +Assertion is the process of pushing a cryptographic challenge to the device, which will return back _signed_ by the private key. Upon arrival, the app checks the signature is correct with the stored public key, ready to **log in**. The private key doesn't leave the authenticator, and there are no shared passwords to save, let alone remember. @@ -151,10 +152,23 @@ This package includes a simple but convenient script to handle WebAuthn Attestat php artisan vendor:publish --provider="Laragear\WebAuthn\WebAuthnServiceProvider" --tag="js" ``` -You will receive the `resources/js/vendor/webauthn/webauthn.js` file which you can include into your authentication views and use it programmatically, anyway you want. For example, compiling it [through Laravel Mix](https://laravel.com/docs/9.x/mix#working-with-scripts) into your application global Javascript. +You will receive the `resources/js/vendor/webauthn/webauthn.js` file which you can include into your authentication views and use it programmatically, anyway you want. For example, [compiling it through Vite](https://laravel.com/docs/9.x/vite#loading-your-scripts-and-styles) into your application global Javascript. ```html - + + + {{-- ... --}} + + @vite(['resources/js/app.js', 'resources/js/vendor/webauthn/webauthn.js']) + +``` + +Once done, you can easily start registering and login in users. For example, for a logged in user, you may show a registration view in HTML with the following code: + +```html +
+