@beeper/webauthn-authenticator

Native Node.js/Electron bindings for webauthn-authenticator-rs, built with napi-rs.

This package targets Electron 41-era runtimes and newer. It ships Node-API prebuilds for:

• Linux x64 and arm64, glibc
• macOS x64 and arm64
• Windows x64 and arm64, MSVC

Install

npm install @beeper/webauthn-authenticator

API

The native methods accept the JSON challenge objects from webauthn-rs-proto and return the credential JSON that should be sent back to the relying party.

const {
  cableRegister,
  cableAuthenticate,
  win10Register,
  win10Authenticate,
  win10ApiVersion,
  win10SupportsCable,
} = require('@beeper/webauthn-authenticator')

const onCableEvent = (event) => {
  if (event.event === 'cableQrCode') {
    // Render event.url as a QR code in the Electron UI.
    console.log(event.requestType, event.url)
  }

  if (event.event === 'dismissQrCode') {
    // Hide the QR code.
  }
}

const credential = await cableRegister(origin, creationChallenge, onCableEvent)
const assertion = await cableAuthenticate(origin, requestChallenge, onCableEvent)

if (process.platform === 'win32') {
  console.log(win10ApiVersion(), win10SupportsCable())
  await win10Register(origin, creationChallenge)
  await win10Authenticate(origin, requestChallenge)
}

Electron Notes

Windows builds expose the Windows Hello WebAuthn API through the upstream win10 module. win10Register() and win10Authenticate() throw an unsupported error outside Windows builds; win10ApiVersion() returns null and win10SupportsCable() returns false.

The caBLE initiator uses Bluetooth LE and a WebSocket tunnel. In Electron:

• Linux requires access to BlueZ over D-Bus, typically by running as a user in the bluetooth group.
• macOS app bundles need NSBluetoothAlwaysUsageDescription in Info.plist; sandboxed apps also need the Bluetooth entitlement.
• Windows 11 systems may support caBLE through the Windows WebAuthn API. Prefer win10* when win10SupportsCable() returns true.

Development

git submodule update --init --recursive
npm install
npm run build:debug
npm test

Debug builds automatically enable Rust logging for caBLE, WebSocket, and BLE internals. Set RUST_LOG before starting Electron to override the default filter:

RUST_LOG=webauthn_authenticator_rs::cable=trace,tungstenite=debug npm start

Trace logs can include raw caBLE and CTAP bytes; treat them as sensitive.

On Linux, install build dependencies before compiling caBLE:

sudo apt-get update
sudo apt-get install -y pkg-config libdbus-1-dev libssl-dev

The package is pinned to webauthn-authenticator-rs 0.6.1-dev. That crate is pre-1.0, so its API can change and the binding should be tested against real authenticators before releases.