fido2-lib

Spec sheet

Purpose

fido2-lib is a Node.js library for implementing FIDO 2.0 and WebAuthn server functionality.Read 5 Oct 2026 · github.com

License

The software is provided under the MIT License, which grants free use, copying, modification, distribution, sublicensing, and sale subject to its conditions.Read 5 Oct 2026 · github.com

Attestation formats

Listed attestation formats are packed, TPM, deprecated Android SafetyNet, FIDO U2F, none, and Apple.Read 5 Oct 2026 · github.com

Audit data

The library returns parsed and validated data together with extra audit data for risk engines.Read 5 Oct 2026 · github.com

Challenge handling

The library does not track sessions or context, so the caller is expected to associate each challenge with a session to match it with a response.Read 5 Oct 2026 · github.com

Cryptography

The listed crypto families are ECDSA and RSA, with x509 certificate parsing and PKITS chain validation.Read 5 Oct 2026 · github.com

Downloads

The README shows installation through npm and import from Deno's deno.land repository; the GitHub Releases page says there are no releases.Read 5 Oct 2026 · github.com

Extensibility

The library provides APIs for adding attestation formats and extensions.Read 5 Oct 2026 · github.com

Integration examples

The README points to OWASP Single Sign-On and webauthn.io for working examples.Read 5 Oct 2026 · github.com

Metadata

Metadata service support provides authenticator root-of-trust and metadata, including support for multiple services such as FIDO MDS 1–3.Read 5 Oct 2026 · github.com

Protocol independence

The library does not implement a networking protocol such as REST endpoints, so it can remain independent of messaging protocols.Read 5 Oct 2026 · github.com

Registration and authentication

Its four primary functions create attestation and assertion challenges and parse and validate the client responses.Read 5 Oct 2026 · github.com

Runtime and modules

The README provides Node.js and Deno installation and import examples, and says CommonJS and ESM are supported natively.Read 5 Oct 2026 · github.com

Security reporting

The security policy asks reporters not to post vulnerabilities in public GitHub issues and says to use private vulnerability reporting or contact the lead maintainer; it says a response should arrive within 48 hours.Read 5 Oct 2026 · github.com

Windows Hello

The project lists Windows Hello as supported.Read 5 Oct 2026 · github.com

Plans and prices

Every fido2-lib plan and price →

Where Specifiction places it

• Biometric Authentication Software#24 of 457.8