WebAuthn.Net

A production-ready, easy-to-use, extensible implementation of the WebAuthn Level 3 standard, passing the FIDO conformance test, for the server side of web applications on .NET 10.

Documentation

The documentation for each project is described in its README.md file.

• WebAuthn.Net
• WebAuthn.Net.Storage.SqlServer
• WebAuthn.Net.Storage.PostgreSql
• WebAuthn.Net.Storage.MySql
• WebAuthn.Net.Storage.InMemory
• WebAuthn.Net.OpenTelemetry

Supported features

• ✅ Passkeys are supported out of the box
• ✅ Attestation API & verification (Register and verify credentials/authenticators)
• ✅ Assertion API & verification (Authenticate users)
• ✅ 100% completion of the entire FIDO Conformance Test, including all optional features
• ✅ Demo application for performing the FIDO Conformance test
• ✅ Demo application demonstrating the capabilities of the library
• ✅ Authenticators embedded in the device (FaceID, TouchID, Windows Hello)
• ✅ Roaming aka cross-platform authenticators (USB/NFC/BLE keys, for example Yubico)
• ✅ All current attestation statement formats
  • packed
  • tpm
  • android-key
  • fido-u2f
  • none
  • apple
• ❌ The android-safetynet attestation statement format is not supported, and a registration that uses it is rejected:
  • Google deprecated the SafetyNet Attestation API in 2022 and turned it down completely in January 2025. Every call to the API now fails, so no authenticator can produce a valid android-safetynet attestation statement anymore.
  • The WebAuthn Level 3 specification marks the format as deprecated and expected to be removed. Its verification procedure relies on the SafetyNet online documentation, which no longer describes how to verify a response.
• ✅ All cryptographic algorithms required to pass the FIDO Conformance Test
  • RS1
  • RS256
  • RS384
  • RS512
  • PS256
  • PS384
  • PS512
  • ES256
  • ES384
  • ES512
  • EdDSA (via libsodium, because .NET currently doesn't support Ed25519)
• ✅ FIDO Metadata Service support: the metadata is verified and refreshed daily, a failed download is retried every minute, and the metadata can be embedded in the application, so that the application starts and works even when the FIDO Metadata Service is unavailable
• ✅ Processing of each request with a single transaction
• ✅ Ready-to-use storage implementations
  • Microsoft SQL Server
  • PostgreSQL
  • MySQL
  • InMemory (for sample applications)
• ✅ Built-in metrics (with an additional library for integrating WebAuthn.Net metrics with OpenTelemetry)
• ✅ Exceptionless design (avoid exceptions wherever possible)
• ✅ Designed with extensibility in mind (almost any library component can be overridden)
• ✅ Intellisense documentation

Local development

Required dependencies

• .NET SDK 10.0.403+

Tips for Contribution

Any contributions appreciated! If you have an idea, feature request, or you find a bug – feel free to open new issue.

Acknowledgements

WebAuthn.Net is built using the following wonderful tools

• .NET
• ASP.NET Core
• JetBrains Rider

WebAuthn.Net is inspired by the wonderful project FIDO2 .NET Library (WebAuthn). However, WebAuthn.Net is not a fork, but a standalone project built entirely from scratch.