Server-Side Passkey Implementation in Java: Pitfall Detection and Backend Support Evaluation

Sammanfattning

Passkeys, built on the FIDO2 standard and its WebAuthn specification, are increasingly replacing passwords in web authentication, but implementing them correctly on the server side can be challenging. Previous studies of deployed passkey servers have found recurring misconfigurations, yet how different backend solutions compare in their handling of the relevant verification checks, and whether their defaults align with known misconfiguration patterns, remains unexamined. This thesis analyzes server-side implementation pitfalls in passkey authentication and evaluates three Java backend solutions against them. Seven pitfalls are identified from the WebAuthn specification and prior empirical work, covering challenge lifecycle management, origin validation, user verification enforcement, and attestation policy. The three solutions, Yubico java-webauthn-server, WebAuthn4J, and Spring Security, are analyzed and assessed based on how much responsibility each takes for preventing these pitfalls versus leaving them to the developer. No single solution handles all pitfalls well. Spring Security automates the most, absorbing challenge management, credential binding, and counter validation, but provides no supported way to configure user verification or attestation policy. WebAuthn4J exposes full control but requires the most protocol knowledge. Yubico's library sits between them. The default configurations of all three are consistent with the patterns documented in prior empirical analyses of live deployments. A command-line detection tool was also developed as a practical contribution intended to help developers identify implementation issues in their own servers. It sends crafted HTTP requests to a locally running server and reports a pass/fail/warn result for six of the seven pitfalls. Validation showed correct detection against a purpose-built misconfigured server and no false positives against Yubico's reference implementation.