How to manage multiple authenticators per user? about webauthn HOT 2 CLOSED

The library does support this and I am using it successfully in this way in more than one website.

You have to store the key information with the user account in your database. The example uses a trivial file system, but you will most likely have a database with a users table, and you need a full text field to store the keys, which are a JSON string.

When calling register(), as well as the info for the registration in progress, you also pass in the current keys field from the user as the second parameter - this parameter can be NULL if you don't have any yet, but otherwise it is a string. The function returns an amended string (representing a set of keys) which you store back in the user keys field in the database. (If you look at the JSON it manages, you'll see it is an array, each element of which is a different key for the user).

When calling authenticate() you pass in the user keys field (again second parameter) and it attempts to authenticate against any of they keys they have registered.

If you use it for 2FA instead of login, the procedure is exactly the same, except that you would have already verified them against a (strongly-hashed) password by the time you do the authenticate() call.

from webauthn.

Hi David,

thanks for the quick answer and the solution.
I was wrong because every time I started the webauthnkeys again.
I changed the initialization in this way and now it's okay.

Best regards

if(empty($user)) {
                $data = [
                    'name' => $username,
                    'id' => md5(time() . '-' . rand(1, 1000000000)),
                    'webauthnkeys' => $webauthn->cancel(),
                ];
            }
            else{
                $data = [
                    'name' => $username,
                    'id' => $user->id,
                    'webauthnkeys' => $user->webauthnkeys,
                ];
            }

from webauthn.