Installation

pip install pywarp

PyWARP depends on cryptography, which in turn requires OpenSSL and CFFI.

Synopsis

from pywarp import RelyingPartyManager, Credential
from pywarp.backends import DynamoBackend  # This is an example. See "storage backends" below for other databases.

rp_id = "myapp.example.com"  # This must match the origin domain of your app, as seen by the browser.
rp = RelyingPartyManager("PyWARP demo", rp_id=rp_id, credential_storage_backend=DynamoBackend())

# Get options for navigator.credentials.create() - pass these to your frontend when registering a user
rp.get_registration_options(email=str)

# Run the protocol in https://www.w3.org/TR/webauthn/#registering-a-new-credential,
# then call the credential storage backend to store the credential public key.
rp.register(attestation_object=bytes, client_data_json=bytes, email=bytes)

# Get options for navigator.credentials.get() - pass these to your frontend when logging in a user
rp.get_authentication_options(email=str)

# Run the protocol in https://www.w3.org/TR/webauthn/#verifying-assertion,
# calling the credential storage backend to retrieve the credential public key.
# If no exception is raised, proceed with user login.
rp.verify(authenticator_data=bytes, client_data_json=bytes, signature=bytes, user_handle=bytes, raw_id=bytes,
          email=bytes)

See examples/chalice/app.py and examples/chalice/chalicelib/index.html (frontend) for a complete example.

Storage backends

Your application is presumably using an application server like uWSGI, a database backend like MySQL, PostgreSQL or MongoDB, and maybe a framework like Flask or Django to tie them together. PyWARP makes no assumptions about your database, schema, or model. Instead, it provides an abstract class (pywarp.backends.CredentialStorageBackend) representing an interface for storing and retrieving WebAuthn credential data for your users.

To deploy PyWARP, declare a subclass of CredentialStorageBackend. In your subclass, implement bindings to your database, then pass an instance of your subclass to pywarp.RelyingPartyManager(credential_storage_backend=...):

class CredentialStorageBackend:
    def __init__(self):
        self.database_client = ...

    def get_credential_by_email(self, email):
        user_record = self.database_client.get(email)
        return Credential(credential_id=user_record["cred_id"],
                          credential_public_key=user_record["cred_pub_key"])

    def save_credential_for_user(self, email, credential):
        self.database_client.update(email, {"cred_id": credential.credential_id,
                                            "cred_pub_key": bytes(credential.public_key)})

    def save_challenge_for_user(self, email, challenge, type):
        self.database_client.update(email, {type + "challenge": challenge})

    def get_challenge_for_user(self, email, type):
        user_record = self.database_client.get(email)
        return user_record[type + "challenge"]

Example: Chalice app

The Chalice app example (in the examples/chalice directory) can be deployed as an AWS Lambda application when used with conventional AWS account credentials (configured via aws configure in the AWS CLI. This example uses DynamoDB as a storage backend.

See the API documentation for more.

Authors

• Andrey Kislyuk

Links

• Project home page (GitHub)

• Documentation (Read the Docs)

• Package distribution (PyPI)

• Change log

Bugs

Please report bugs, issues, feature requests, etc. on GitHub.

License

Licensed under the terms of the Apache License, Version 2.0.