SitePoint19 min readtutorialintermediate
WebAuthn Passkey Recovery: Building Account Fallbacks and Backup Codes in Node.js
Summary
A step‑by‑step tutorial for building a zero‑trust WebAuthn passkey recovery flow in Node.js/TypeScript. It covers generating 128‑bit backup codes, hashing them with Argon2id, rate‑limited verification, time‑boxed JWT recovery sessions, and orchestrating new credential registration with @simplewebauthn/server while revoking lost credentials and rotating codes.
- Backup codes must have ≥128 bits of entropy; generate with crypto.randomBytes and preserve the full base64url alphabet.
- Hash each code with Argon2id (OWASP parameters) and store only the hashes; verify in constant‑time against unused hashes.
- Use a rate‑limited endpoint (e.g., 5 attempts/15 min) and a short‑lived (10 min) JWT stored in an HttpOnly, Secure, SameSite=Strict cookie to bound the recovery session.
- Recovery flow is a finite‑state machine: AUTHENTICATED → PASSKEY_LOST → RECOVERY_INITIATED → BACKUP_CODE_VERIFIED → NEW_CREDENTIAL_REGISTERED → RECOVERY_COMPLETE.
Passkey loss is the biggest obstacle to passwordless adoption; without a secure, password‑free recovery path users revert to passwords, negating phishing‑resistant benefits. This guide shows how to retain zero‑trust security while providing a practical fallback that can be deployed in production se…
6/10
