I'm working with Claude to improve my Plone site. this has some great advantages but has one drawback: I quickly get into areas for which I have no experience and don't know if the path I am considering is one I should consider.
I want to simplify logging in. I have two options I've considered , one of which I've implemented.
-
setting cookes to 30 day. this keeps the username/pwd in the login box so users press ok/enter and their in. simple.
-
the other option is the Windows PassKey (correct name?). I've seen most high security applications (GitHub) are moving to passkeys, so i investigated with claude. I'll post my question first, then list what Claude provided as an implementation outline.
My Question: has anyone implemented a PassKey? Any suggestions on if I should pursue this, even as a test case? thoughts and suggestions appreciated.
Here is what Claude replied
Add the library — webauthn to setup.py; it does the crypto and verification.
Store credentials per user — credential ID, public key, signature counter, device label, date added. A member property fits the pattern you already use for user_icon / your_team_role. One user can have several (laptop + desktop).
A PAS plugin — registered in acl_users, validates a signed challenge and returns the user, then issues the same session ticket you already use. This is what makes the 30-day cookie keep working unchanged.
Two endpoints
Enrol — issues a challenge, verifies what Windows sends back, saves the credential
Sign in — issues a challenge, verifies the signature, logs the user in
Challenge handling — short-lived, single-use, server-side. Getting this wrong is the classic security hole.
UI — a "Sign in with Windows Hello" button on the login page, and "Set up passkey" in the account menu you already have.
Per-tenant config — the passkey is bound to the exact domain. Must come from config, never hardcoded, since every tenant has its own.
Recovery — keep password login, and give admins a way to remove a lost device's passkey.
---------------------------------------------------------------------**
Windows side (mostly configuration)**
Nothing to install. It's built into Windows and the browser — no MSI, no agent.
Requirements — Windows 11 (or 10 22H2), TPM, Windows Hello set up with at least a PIN.
Browsers — current Edge or Firefox. The Edge app inherits it automatically.
Enrolment — user clicks "Set up passkey", Windows prompts for PIN or fingerprint, done. Once per person per machine per site.
One policy decision — let passkeys sync to the user's Microsoft account (follows them to a new PC) or stay locked to the device (more secure, but a dead laptop means re-enrolment). Controllable by group policy.