node-red-contrib-webauthn-variable

WebAuthn registration and authentication operations for Node-RED, executed directly inside the Node-RED runtime with @simplewebauthn/server.

The node does not start an HTTP server and does not open any network ports. It can be connected to existing Node-RED HTTP, database, session, and Redis nodes.

Features

• Generate WebAuthn registration options
• Verify WebAuthn registration responses
• Generate WebAuthn authentication options
• Verify WebAuthn authentication assertions
• Restrict allowed origins and RP IDs
• Accept input from msg.payload or another message path
• Separate success and error outputs
• Return credential metadata such as transports, attachment modality, AAGUID, device type, and backup state when available

Requirements

• Node.js 18 or newer
• A WebAuthn-capable browser
• HTTPS, except for browser-supported localhost development

Installation

Install from the Node-RED user directory:

cd ~/.node-red
npm install node-red-contrib-webauthn-variable

Restart Node-RED after installation.

Node configuration

The package adds the webauthn-actions node to the security category.

• RP Name: Human-readable relying-party name used during registration.
• Default Action: Operation performed when no dynamic action is supplied.
• Body source: Read the request from msg.payload or another message path.
• Allowed Origins: Optional comma-separated allowlist such as https://example.com.
• Allowed RP IDs: Optional comma-separated allowlist such as example.com.

The configured action can be overridden for each message:

msg.webauthn = {
    action: "verify-authentication"
};

Supported actions

generate-registration-options

Generates options for navigator.credentials.create().

verify-registration

Verifies the response returned by navigator.credentials.create() and returns the credential ID, public key, counter, and available authenticator metadata.

generate-authentication-options

Generates options for navigator.credentials.get() using registered credential IDs or credential descriptors.

verify-authentication

Verifies an authentication assertion using the stored credential public key and signature counter.

Outputs

The node has two outputs:

1. ok — the operation completed and msg.payload.ok === true.
2. error — validation or WebAuthn verification failed.

Successful registration verification can include:

{
  "ok": true,
  "credential": {
    "credentialId": "base64url credential id",
    "credentialPublicKey": "base64url COSE public key",
    "counter": 0,
    "transports": [],
    "authenticatorAttachment": "cross-platform",
    "aaguid": "00000000-0000-0000-0000-000000000000",
    "credentialDeviceType": "singleDevice",
    "credentialBackedUp": false
  }
}

Authenticator metadata is optional. In particular, an empty transports array is valid and means that the browser did not provide transport information.

Security responsibilities

This node performs WebAuthn option generation and cryptographic verification. The surrounding flow must also:

• Generate a new challenge for every ceremony
• Store challenges server-side with a short expiration time
• Bind each challenge to the correct user, RP ID, and operation
• Consume each challenge exactly once
• Store credential IDs, public keys, counters, and metadata in a database
• Update the signature counter after successful authentication
• Use fixed or allowlisted origins and RP IDs
• Require user verification when appropriate
• Return authentication success only after cryptographic verification succeeds

Do not trust credential IDs, authenticator attachment values, transports, or other client-supplied metadata as proof of a particular device model. Use verified attestation and a suitable metadata policy when hardware provenance is required.

License

MIT