Cybersecurity · beginner
Phishing-Resistant Login with Passkeys (WebAuthn)
A working web app where users register and sign in with a passkey — a fingerprint, face, or security key — instead of a password. You build the relying party end to end and can explain why a phishing site cannot steal the credential.
Project overview
Passkeys are replacing passwords across Apple, Google, and Microsoft platforms, and identity is the top security spending category in 2026. A candidate who has implemented a relying party understands challenge-response, origin binding, and credential storage better than most working developers.
Real-world use case
A small SaaS keeps losing accounts to credential-stuffing attacks. Moving login to passkeys ends password reuse and phishing in one change, with a faster sign-in for users.
Tools and technologies
- Node.js
- SimpleWebAuthn
- React
- SQLite
- WebAuthn / FIDO2
Skills you can demonstrate
Authentication Protocols, Public-Key Cryptography Basics, Identity and Access Management, Web Security, API Design
Build roadmap
- Build the shell app
A React front end with register and login pages and a Node API with a users table. Serve it over HTTPS locally — WebAuthn requires a secure context. - Implement registration
Generate registration options on the server, call the browser API, verify the response, and store the public key and credential id. Test it with your laptop’s built-in authenticator. - Implement authentication
Generate a challenge, call the browser API, verify the signature against the stored public key, and issue a session. Confirm the signature counter is tracked. - Handle multiple credentials
Let a user register a second passkey (phone plus laptop) and manage them from a settings page. Deleting the last one should require confirmation. - Try to break it
Change the origin, replay an old response, tamper with the challenge. Each should fail with a clear server error. Document what you tried. - Write the explainer
A README section that explains, without jargon, why a fake login page cannot capture a passkey. This is what you will say in the interview.
Ways to extend the project
Add conditional UI (autofill passkeys), cross-device sign-in with a QR code, and a recovery flow that does not fall back to a weak password.
How to showcase your work
- GitHub: The app, a README with the two sequence diagrams, and a section titled "why phishing fails against this" written in plain language.
- LinkedIn: Record registering a passkey and signing in with a fingerprint on a phone in under 15 seconds. The speed is the message.
- Resume: Lead with "WebAuthn / FIDO2 passkey authentication" and "phishing-resistant identity", then mention the relying-party implementation.