Actions
User Story #237
open
Epic #3: Implement a secure user authentication system
Feature #160: User Login
As a user, I want to log in using a security key (WebAuthn/passkey), so that I can use phishing-resistant MFA
User Story #237:
As a user, I want to log in using a security key (WebAuthn/passkey), so that I can use phishing-resistant MFA
Status:
Draft
Priority:
Normal
Assigned To:
-
Start date:
08/12/2026
Due date:
% Done:
0%
Estimated time:
(Total: 0:00 h)
Description
This user story covers WebAuthn-based multi-factor authentication (passkeys and hardware security keys).
Acceptance requirements:
- Users can register one or more WebAuthn credentials from their profile
- Users with a registered security key are prompted to use it during the MFA login step
- The login flow correctly handles cancellation and unsupported browser scenarios
- Credentials are bound to the user and stored securely (public key, credential ID, sign count)
- Sign count is verified on each assertion to detect cloned authenticators
Updated by
Actions