SimpleWebAuthn

Facts and the checks behind them

Nothing below is copied from documentation. The check content/libraries/verify/simplewebauthn/run.sh ran SimpleWebAuthn 14.0.3 on Node.js 24.22.0 in the container image node:24.22.0-bookworm-slim on October 20, 2026; the page must match what it printed, and each fact lists those lines.

• Default COSE algorithms

  -48-8-7-257

  generateRegistrationOptions() lists COSE algorithms -48 (ML-DSA-44), -8 (Ed25519), -7 (ES256) and -257 (RS256), in that order.

  Recorded by the check

  fact webauthn-default-algorithms = -48, -8, -7, -257

• Default attestation

  none

  Attestation conveyance defaults to none.

  Recorded by the check

  fact webauthn-attestation = none

• Default user verification

  preferred

  authenticatorSelection.userVerification defaults to preferred.

  Recorded by the check

  fact webauthn-user-verification = preferred

• Default resident key

  preferred

  authenticatorSelection.residentKey defaults to preferred.

  Recorded by the check

  fact webauthn-resident-key = preferred

• User verification enforced by default

  yes

  Both verifiers require the UV flag unless requireUserVerification: false is passed: a registration and an assertion with only UP set were refused with User verification was required, but user could not be verified and User verification required, but user could not be verified.

  Recorded by the check

  fact webauthn-uv-enforced-by-default = yes
  evidence webauthn-uv-enforced-by-default: registration with the UV flag clear: throws User verification was required, but user could not be verified

• Assertion signature encoding

  der

  A correct ES256 assertion with an ASN.1 DER signature verified.

  Recorded by the check

  fact webauthn-assertion-encoding = der

• Raw r‖s assertion signature

  rejected

  The same assertion with a raw 64-byte r‖s signature threw an ASN.1 parsing error whose wording depends on the signature bytes.

  Recorded by the check

  fact webauthn-raw-signature = rejected

• High-S assertion signature

  accepted

  A DER signature with s replaced by n − s verified.

  Recorded by the check

  fact webauthn-high-s = accepted

• Signature counter going back

  rejected

  A counter below the stored value threw Response counter value 3 was lower than expected 5; a counter of 0 after a stored 5 was refused too, while 0 after a stored 0 verified.

  Recorded by the check

  fact webauthn-counter-regression = rejected
  evidence webauthn-counter-regression: counter 0 after a stored 5: throws Response counter value 0 was lower than expected 5; counter 0 after a stored 0: verified

• Ed25519 credentials

  supported

  An Ed25519 (COSE -8) credential registered and authenticated successfully.

  Recorded by the check

  fact webauthn-ed25519 = supported
  evidence webauthn-ed25519: verified

Usage

import { generateAuthenticationOptions, generateRegistrationOptions } from "@simplewebauthn/server";

const rpID = "example.com";

// Registration: the options ask for UV only as "preferred"...
const registration = await generateRegistrationOptions({
  rpName: "Example",
  rpID,
  userName: "user@example.com",
  authenticatorSelection: { residentKey: "required", userVerification: "required" },
});

// ...while verifyRegistrationResponse() and verifyAuthenticationResponse()
// require the UV flag by default. Ask for "required" up front (as here), or pass
// requireUserVerification: false when a security key without a PIN is acceptable.
const authentication = await generateAuthenticationOptions({ rpID, userVerification: "required" });

console.log("algorithms:", registration.pubKeyCredParams.map((param) => param.alg).join(", "));
console.log("uv:", registration.authenticatorSelection?.userVerification, authentication.userVerification);
console.log("challenge bytes:", Buffer.from(authentication.challenge, "base64url").length);