Passwordless sign-in, included
Every generated project ships passkey support, with no Cargo feature to choose and nothing to configure. Users who signed up with a verified email can attach a passkey from Account settings after confirming their password. The sign-in page then offers Sign in with a passkey, and browsers that support it list the passkey in the email field's autofill.
Passkeys never create accounts: signup keeps its emailed verification code, and only a signed-in account holder can add one. Each account can hold ten passkeys; removing one is a plain form in settings.
How it is built
- The relying-party id is the host of
SITE_URL, and the browser must report that exact origin. Local development onhttp://localhost:3000works. - Registration asks for discoverable credentials with user verification required and no attestation; sign-in verifies the user-present and user-verified flags, the challenge, the origin and the signature counter.
- ES256, RS256 and EdDSA credentials are accepted. Signatures are verified
with
ring, which rustls already brings into every ShipRust binary, so there is no OpenSSL and no new native dependency. - Challenges are single-use rows in Postgres, valid for ten minutes, so the flow works across replicas.
- The JSON endpoints under
/passkeys/require the site's ownOrigin, like the signup forms.
The verification code lives in the shared shiprust-auth crate
(webauthn.rs and passkeys.rs), the handlers in app/src/passkeys.rs, and
the browser side in app/assets/passkeys.js. Integration tests use a
software authenticator, so the whole ceremony is exercised without a browser.
The generated project's docs include a Passkeys guide with the details.