Webauthn Framework Laravel Package

Product Decisions This Supports

• Passwordless / passkey roadmap. This is the server-side WebAuthn (FIDO2) engine: it lets us ship "add a passkey" and passwordless sign-in without inventing ceremony, attestation, or signature-verification logic. It directly gates the decision to move from "passwords + TOTP" to "passkeys first, password as fallback."
• Build vs. buy. The clear "adopt" case. Implementing CBOR/COSE parsing, attestation statement verification across formats, origin/RP-ID validation, and signature-counter regression checks in-house is months of specialist work with a permanent security-maintenance tail. We buy that from an actively patched upstream.
• Security and compliance posture. Phishing-resistant MFA is the direction of travel for enterprise procurement, auditors, and regulated flows (NIST AAL3-style expectations, PSD2-style SCA, insurer/vendor questionnaires). Choosing a spec-conformant library is a compliance input, not just an engineering one.
• Feature scope decisions this unblocks. Attestation policy (none vs. indirect/direct/enterprise), whether to support conditional UI / username-less autofill, multi-device synced passkeys vs. hardware keys only, and how long we keep SMS OTP alive alongside.
• Supply-chain risk decision. Release 5.3.9 raises the floor on two binary-format parsers (cbor-php ^3.4, cose-lib ^4.8). Binary parsers are exactly the surface we want patched promptly, so the PM call is: treat patch releases here as routine-and-take-them, and keep a named owner for the composer bump.
• Front-end/back-end version coupling. The release also publishes @web-auth/webauthn-stimulus 5.3.9 to NPM, so PHP and JS helper versions move in lockstep — a coordination item for the delivery plan, not just a dependency detail.

When to Consider This Package

Adopt when:

• We're on PHP/Laravel and need genuine server-side WebAuthn verification, not a hosted redirect.
• We need breadth: multiple attestation formats, algorithm coverage (ES256/RS256/EdDSA), AAGUID/metadata handling, and a maintained upstream with a track record of fast security patches (5.3.9 is a one-PR dependency/security patch — a good sign, not a red flag).
• We accept owning credential storage, RP ID/origin configuration, and attestation policy ourselves.
• We plan to add a thin Laravel integration layer (routes, controllers, Eloquent credential model, Blade/JS glue). This package is framework-agnostic; the Laravel ergonomics are ours to build or take from a community wrapper.

Look elsewhere or defer when:

• We only need a second factor and TOTP/SMS already satisfies the requirement — WebAuthn adds ceremony UX, origin configuration, and support burden for marginal gain.
• We can't guarantee HTTPS plus correct RP ID/origin setup across all environments (staging, mobile webviews, custom domains). Misconfiguration here fails silently and confusingly.
• We want an outsourced, fully managed passkey provider and don't want to own credential lifecycle or attestation trust decisions.
• The team can't absorb the composer dependency graph and the crypto/ceremony learning curve in the current quarter.

Release-specific note (5.3.9): tagged break, bug, dependencies, security but it is a patch with zero issues and a single PR tightening dependency constraints. No API changes for us. Before merging: run the full suite, check composer why-not for conflicts if we pin cbor-php/cose-lib ourselves, and confirm the NPM helper version matches.

How to Pitch It (Stakeholders)

To executives: Passkeys are the single highest-leverage reduction in account takeover and phishing we can make this year, and they're increasingly what enterprise buyers and auditors expect to see. Adopting a proven library gets us to passwordless in weeks rather than quarters; the cost is integration engineering plus routine patch-level maintenance. Release 5.3.9 is exactly the kind of maintenance we want — a small patch that lifts our floor on two crypto-format parsers.

To engineering: WebAuthn on the server is a minefield of CBOR/COSE parsing, attestation trust chains, and signature-counter handling; this package owns all of it and is actively patched. It's patch-compatible and safe to pin. Expect real work in the Laravel glue — RP ID/origin config, credential model and migrations, registration and authentication ceremony endpoints, and JS via the lockstep @web-auth/webauthn-stimulus (or equivalent) bundle. Prioritise tests around origin validation, counter regression, and duplicate-credential handling. Merge 5.3.9 on the normal cadence; verify no composer constraint conflicts and keep PHP and JS versions aligned.