Add Passwordless Passkey Login to Your Spring Security App with Fingerprint or Face ID

Spring Security 7.1 now includes native support for Passkey (WebAuthn), allowing users to log in with a fingerprint, Face ID, Windows Hello, device PIN, or a security key instead of a password.

1. Passkey vs. traditional password login

Traditional login stores a password hash on the server and validates it with BCrypt. Passkey registration generates an asymmetric key pair on the authenticator: the private key stays on the device, while the public key is stored on the server. The server no longer holds any secret that can be used to authenticate the user.

2. What Spring Boot validates during login?

When a user logs in with a Passkey, Spring Boot creates a random challenge and sends it to the browser. The device signs the challenge with its private key, and the signature is verified on the server using the stored public key.

Spring Boot → generate random Challenge → send to browser
Browser → fingerprint/Face ID confirmation → device signs Challenge
Server → verify signature with stored public key → authentication success

The W3C WebAuthn spec requires the challenge to be generated in a trusted environment and checked on return, preventing replay attacks.

3. Enabling Passkey in Spring Boot

Add the spring-security-webauthn module and enable it via HttpSecurity.webAuthn():

org.springframework.security:spring-security-webauthn

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/css/**", "/js/**").permitAll()
                .anyRequest().authenticated())
            .formLogin(Customizer.withDefaults())
            .webAuthn(webAuthn -> webAuthn
                .rpId("example.com")
                .allowedOrigins("https://example.com"));
        return http.build();
    }
}

The two important parameters are: .rpId("example.com") – the Relying Party identifier, i.e., the site that owns the Passkey. .allowedOrigins("https://example.com") – limits which origins may initiate authentication, protecting against phishing.

4. Registering a Passkey

Registration is a two‑step process. The backend provides registration options via /webauthn/register/options, the browser calls navigator.credentials.create(), the user confirms with biometrics, and the resulting public‑key credential is saved by Spring Security.

User logged in → click “Create Passkey”
Spring Boot generates challenge → returns WebAuthn options
Browser calls navigator.credentials.create()
Device asks for fingerprint/Face ID → generates key pair
Browser returns public‑key credential → Spring Security stores it

Frontend code example:

const credential = await navigator.credentials.create({
    publicKey: options
});

5. Passwordless login after registration

On subsequent logins the flow changes to:

Spring Boot → generate authentication Options → send to browser
Browser → navigator.credentials.get()
Device → prompt biometric → sign challenge with private key
Server → verify signature with stored public key → authentication success

The default endpoints are POST /webauthn/authenticate/options and POST /login/webauthn.

6. Persisting credentials in production

In‑memory storage is fine for demos but not for production because a server restart would lose all Passkeys. Spring Security provides JDBC repositories:

@Bean
JdbcPublicKeyCredentialUserEntityRepository webAuthnUsers(JdbcOperations jdbc) {
    return new JdbcPublicKeyCredentialUserEntityRepository(jdbc);
}

@Bean
JdbcUserCredentialRepository credentials(JdbcOperations jdbc) {
    return new JdbcUserCredentialRepository(jdbc);
}

A typical schema includes tables for users and webauthn_credentials (credential_id, public_key, sign_count, label, user_id). Multiple Passkeys per user are recommended to avoid lock‑out when a device is lost.

7. Security benefits of Passkey

Passkey eliminates server‑side secret storage, mitigates password reuse, phishing, credential leaks, and SMS‑based attacks. Even if an attacker obtains the public key from the database, they cannot forge a valid signature because the private key never leaves the authenticator.

8. Migration considerations

Do not remove password login immediately. A phased migration is advised:

Phase 1: username + password + Passkey

Phase 2: Passkey becomes the default, password is a fallback

Phase 3: high‑security users move to passwordless only

Plan for device loss, account recovery, credential revocation, and limits on the number of Passkeys per account.

9. Conclusion

Spring Security now bundles the full WebAuthn/Passkey stack, so Java developers can implement modern, password‑less authentication without writing low‑level cryptographic code. By configuring the dependency, enabling webAuthn(), and using the provided JDBC repositories, you can replace traditional password flows with a more secure, user‑friendly experience.