- What is farsh4d/webauthn-framework used for in Laravel?
- It is a WebAuthn framework for Laravel and PHP apps that adds passwordless sign-in with passkeys, biometrics, and security keys. It handles FIDO2 credential registration, authentication challenges, and credential storage so developers can integrate WebAuthn flows into existing applications. The package is a self-declared copy of web-auth/webauthn-framework 4.9.2 with some personal changes.
- How do I install farsh4d/webauthn-framework?
- You install it with composer require farsh4d/webauthn-framework, then wire the library manually. Implement PublicKeyCredentialSourceRepository and PublicKeyCredentialUserEntityRepository against Eloquent, and expose routes such as /webauthn/register/* and /webauthn/authenticate/*. The assessment estimates about 3 days for a happy-path demo but 3 to 4 weeks for a hardened production flow by a Laravel engineer new to WebAuthn.
- Does farsh4d/webauthn-framework support Laravel 10 or 11?
- The provided context does not specify Laravel version support. It notes the fork pins to web-auth/webauthn-framework 4.9.2 with undocumented deltas, so Laravel compatibility is not documented. The assessment recommends using upstream web-auth/webauthn-lib directly with your own Laravel glue instead.
- Is farsh4d/webauthn-framework safe for production authentication?
- The assessment recommends not adopting it for production. It is a security-critical authentication-path dependency from a fork with a single maintainer, 0 stars, and 0 dependents, and it does not receive upstream security advisories or patches. The undocumented personal changes are unverified and untested by anyone but the author. Use upstream web-auth/webauthn-lib or write a thin Laravel wrapper instead.
- What are the differences between farsh4d/webauthn-framework and web-auth/webauthn-framework?
- The fork is a self-declared copy of web-auth/webauthn-framework 4.9.2 with some changes for personal use, but those changes are undocumented. You cannot diff them against upstream without doing the work yourself, and any behavioral difference is unverified. The fork pins to 4.9.2 with unknown deltas, while upstream is the de facto FIDO2/WebAuthn implementation for PHP.
- How do I test WebAuthn flows with farsh4d/webauthn-framework?
- The context does not describe testing utilities for the fork. Because its changes are undocumented and untested by third parties, any testing would need to validate both upstream behavior and the fork's unknown deltas. The assessment recommends defaulting to upstream web-auth/webauthn-lib, which has production deployments and community testing.
- What alternatives to farsh4d/webauthn-framework should I use in Laravel?
- The recommended alternative is upstream web-auth/webauthn-lib directly, plus about 300 lines of Laravel glue to implement the credential source repository, user entity repository, and routes. The Symfony bundle is only appropriate if you build on Symfony. The fork adds an unnecessary Symfony bundle and unused service definitions to your dependency graph.
- How do I configure credential storage for WebAuthn in Laravel?
- With the underlying design, you implement PublicKeyCredentialSourceRepository and PublicKeyCredentialUserEntityRepository against Eloquent. The Relying Party entity, user entity interface, and credential source repository are the three seams to implement. The fork inherits a Doctrine-backed credential source repository from upstream, but you would replace it with Eloquent for Laravel.
- Is farsh4d/webauthn-framework actively maintained?
- It has a single maintainer, 0 stars, 0 dependents, and a trust score around 2.5/100. The fork pins to upstream 4.9.2 with unknown deltas, and there is no indication of security response ownership. The assessment states no third party has ever run this code in production, while upstream web-auth packages publish advisories and patches.
- What are the supply-chain risks of using farsh4d/webauthn-framework?
- The core risk is adopting a security-critical authentication dependency from a fork whose only stated purpose is one person's private modifications. It does not receive upstream security advisories or patches, and package identity confusion with namespace collisions and Composer replace semantics could create a mixed tree of forked and upstream code paths. Fork drift means upgrading requires re-applying an unknown patch set or discarding it. The assessment recommends not adopting the fork.