Crate oauth2_passkey

Expand description

§oauth2-passkey

A minimal-dependency, security-focused authentication library for Rust web applications supporting both OAuth2 and WebAuthn/Passkey authentication.

This framework-agnostic core library provides authentication coordination between OAuth2, WebAuthn/Passkey, and session management, with flexible storage backends.

§Key Features

🔐 Secure Session Management: Automatic cookie handling with CSRF protection
🌐 OAuth2 Authentication: Google OAuth2/OIDC support
🔑 WebAuthn/Passkey Authentication: FIDO2 compliant
📦 Minimal Dependencies: Security-focused design philosophy
🔌 Flexible Storage: Support for SQLite, PostgreSQL, Redis, and in-memory caching

§Usage

This crate provides the core authentication functionality that can be used directly or through framework-specific integration crates like oauth2-passkey-axum.

use oauth2_passkey::{init, SessionUser};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Initialize authentication (reads configuration from environment variables)
    init().await?;

    // Now authentication functions can be used
    // (usually through a web framework integration)

    Ok(())
}

See the repository documentation for more details on configuration and advanced usage.

Structs§

AuthResponse: Response from an OAuth2 authorization request
AuthenticationOptions: Options for initiating a WebAuthn authentication request.
AuthenticationStatus: Indicates the overall authentication status of a session.
AuthenticatorInfo: Information about a passkey authenticator device.
AuthenticatorResponse: Response from the authenticator during a WebAuthn authentication flow.
CsrfHeaderVerified: Indicates whether the CSRF token was verified via an HTTP header.
CsrfToken: CSRF (Cross-Site Request Forgery) token for request validation.
DbUser: Represents a core user identity in the system
OAuth2Account: Represents an OAuth2 account linked to a user
PasskeyCredential: Stored credential information for a WebAuthn/Passkey.
RegisterCredential: Credential data received during WebAuthn registration.
RegistrationOptions: Options for initiating a WebAuthn registration request.
RegistrationStartRequest: Request for starting passkey registration with explicit mode.
SessionUser: User information stored in the session.

Enums§

CoordinationError: Errors that can occur during authentication coordination
OAuth2Mode: Mode of OAuth2 operation to explicitly indicate user intent.
SessionError: Errors that can occur during session management operations.

Statics§

O2P_ROUTE_PREFIX: Route prefix for all oauth2_passkey endpoints
SESSION_COOKIE_NAME: Name of the session cookie used for authentication.

Functions§

delete_oauth2_account_admin: Deletes an OAuth2 account as an administrator.
delete_oauth2_account_core: Delete an OAuth2 account for a user
delete_passkey_credential_admin: Deletes a passkey credential as an administrator.
delete_passkey_credential_core: Delete a passkey credential for a user
delete_user_account: Delete a user account and all associated OAuth2 accounts and Passkey credentials
delete_user_account_admin: Completely deletes a user account as an administrator.
generate_page_session_token: Generates a page session token for synchronizing sessions across pages.
get_all_users: Retrieves a list of all users in the system.
get_authenticator_info: Retrieves information about an authenticator based on its AAGUID.
get_authenticator_info_batch: Retrieves information for multiple authenticators in a batch.
get_authorized_core: Processes an OAuth2 GET authorization request.
get_csrf_token_from_session: Retrieves the CSRF token from a session.
get_related_origin_json: Generates a JSON configuration for cross-origin WebAuthn credential use.
get_user: Retrieves a specific user by their ID.
get_user_and_csrf_token_from_session: Retrieves both user information and CSRF token from a session.
get_user_from_session: Retrieves user information from a session cookie.
handle_finish_authentication_core: Core function that handles the business logic of finishing authentication
handle_finish_registration_core: Core function that handles the business logic of finishing registration
handle_start_authentication_core: Core function that handles the business logic of starting authentication
handle_start_registration_core: Core function that handles the business logic of starting registration with provided user info
init: Initialize the authentication coordination layer
is_authenticated_basic: Check if the request is authenticated by examining the session headers
is_authenticated_basic_then_csrf: Performs basic authentication and returns the CSRF token if successful.
is_authenticated_basic_then_user_and_csrf: Performs authentication and returns the user data and CSRF token.
is_authenticated_strict: Performs strict session authentication, verifying the user exists in the database.
is_authenticated_strict_then_csrf: Performs strict authentication and returns the CSRF token if successful.
list_accounts_core: Lists all OAuth2 accounts associated with a user.
list_credentials_core: Core function that handles the business logic of listing passkey credentials
post_authorized_core: Processes an OAuth2 POST authorization request.
prepare_logout_response: Prepare a logout response by removing the session cookie and deleting the session from storage
prepare_oauth2_auth_request: Prepares an OAuth2 authentication request URL and necessary headers.
update_passkey_credential_core: Update the name and display name of a passkey credential
update_user_account: Update a user’s account and label
update_user_admin_status: Updates a user’s administrative status.
verify_page_session_token: Verifies that a page session token matches the current session’s CSRF token.

Crate oauth2_passkeyCopy item path