✨ Key Features

• PASSWORDLESS AUTHENTICATION
  • Sign in using biometrics (fingerprint, Face ID, Windows Hello) or device PIN
  • No more forgotten passwords or password reset requests
  • Significantly faster checkout process
• ENHANCED SECURITY
  • Phishing-resistant authentication using FIDO2/WebAuthn standards
  • Cryptographic keys instead of vulnerable passwords
  • Protection against credential stuffing and password reuse attacks
  • Domain-bound credentials prevent man-in-the-middle attacks
• MULTI-DEVICE SUPPORT
  • Register multiple passkeys per customer account
  • Platform authenticators (Windows Hello, Touch ID, Face ID)
  • Cross-platform authenticators (USB security keys like YubiKey)
  • Works across desktop, mobile, and tablet devices
• USER-FRIENDLY INTERFACE
  • Beautiful, modern passkey management interface
  • Simple one-click authentication
  • Clear visual feedback during registration and sign-in
  • Intuitive customer account passkey management page
  • Optional promotional popup to encourage adoption
• SEAMLESS INTEGRATION
  • Integrates with standard nopCommerce login flow
  • Works alongside traditional password authentication
  • No disruption to existing customers
  • Gradual migration path to passwordless
• COMPREHENSIVE ADMIN TOOLS
  • View and manage all customer passkeys
  • Filter by store, customer, and date range
  • Paginated credential list with search
  • Individual credential deletion capability
  • Multi-store support with per-store configuration
• STANDARDS-BASED IMPLEMENTATION
  • W3C WebAuthn specification compliance
  • FIDO2/FIDO Alliance certified approach
  • Support for ES256, ES384, ES512, RS256, PS256, EdDSA algorithms
  • Attestation support for enterprise requirements (optional)
• ADVANCED SECURITY FEATURES
  • Sign counter monitoring for cloning detection
  • User verification enforcement (biometric/PIN required)
  • Backup state tracking for synced credentials
  • Comprehensive security event logging
  • Anti-replay attack protection

💼 Business Benefits

⚙️ Technical Specifications

Platform Requirements

• nopCommerce 4.80
• HTTPS (SSL certificate required)
• Compatible browsers: Chrome 108+, Firefox 119+, Safari 16+, Edge 108+

WebAuthn Features

• Discoverable credentials (usernameless authentication)
• Resident key support
• User verification required mode
• Multiple cryptographic algorithm support
• Transport hints (USB, NFC, BLE, internal)

Database

• Efficient indexed credential storage
• Binary storage for cryptographic keys
• Per-store credential isolation
• Foreign key relationships to customers and stores

Performance

• Fast credential lookup with optimized indexes
• Minimal overhead on authentication flow
• Async/await patterns throughout
• Efficient batch operations in admin panel

👥 Customer Features

For Your Customers

• Create and manage passkeys from account page
• View all registered passkeys with creation dates
• Remove passkeys they no longer use
• Sign in with one click using biometrics
• Usernameless authentication (no username entry required)
• Support for multiple devices and authenticators
• Secure backup through device ecosystem (iCloud Keychain, Google Password Manager)

Customer Workflow

1. Navigate to Passkeys section in account area
2. Click "Create a passkey"
3. Follow browser/OS prompt for biometric verification
4. Passkey created instantly
5. Sign in anytime with one touch

🔧 Admin Features

Configuration

• Enable/disable plugin globally or per store
• Customize promotional popup message with HTML editor
• Debug logging with downloadable log files
• License key management
• Multi-store configuration overrides

Credential Management

• View all passkeys across all customers
• Search and filter by store, customer, date range
• Paginated list with detailed credential information
• Delete problematic or compromised credentials
• Export capability (planned)

🛡️ Security Highlights

Threats Mitigated

• Password phishing (credentials are domain-bound)
• Password reuse across sites
• Credential stuffing attacks
• Weak password vulnerabilities
• Password database breaches (no passwords to leak)
• Man-in-the-middle attacks
• Brute force attacks

Security Validations

• Challenge-response with cryptographically secure random challenges
• Origin validation (prevents use on fake sites)
• Signature verification using stored public keys
• User presence verification (UP flag)
• User verification enforcement (UV flag)
• Sign counter progression monitoring
• Backup state consistency checks

🌐 Browser Compatibility

Supported Browsers

Authenticator Support

• Windows Hello (fingerprint, face, PIN)
• Apple Touch ID / Face ID (Mac, iPhone, iPad)
• Android biometric authentication
• USB security keys (YubiKey, Titan, Feitian)
• NFC security keys
• Bluetooth authenticators

📊 Comparison: Passwords vs Passkeys

🎯 Use Cases

Perfect For

• E-commerce stores prioritizing security
• Mobile-first stores (easier mobile authentication)
• B2B stores with frequent returning customers
• Subscription-based stores
• High-value product stores
• Stores targeting tech-savvy demographics
• Multi-store installations
• Stores with international customers

Industry Applications

🚀 Installation

Quick Start

1. Upload plugin via Admin → Configuration → Local plugins
2. Click "Install" and restart application
3. Database migration runs automatically
4. Navigate to Admin → FoxNetSoft → Passkeys → Configure
5. Enable plugin and configure settings
6. Done! Customers can now create passkeys

Requirements

• HTTPS must be configured (required for WebAuthn)
• Valid SSL certificate (self-signed may not work)
• Modern browser on customer device

❓ Frequently Asked Questions

🌟 Why Choose Passkeys?

The Future of Authentication

Passkeys represent the next generation of web authentication, backed by Apple, Google, Microsoft, and the FIDO Alliance. Major platforms are actively promoting passkey adoption:

• Apple: Built into iCloud Keychain across all devices
• Google: Integrated with Google Password Manager
• Microsoft: Windows Hello integration
• Industry momentum: Adoption by PayPal, eBay, Best Buy, and more

Proven Technology

• Based on public key cryptography (same as SSH, TLS)
• Years of development by W3C and FIDO Alliance
• Battle-tested by billions of authentication events
• Supported by all major browser vendors

Investment Protection

• Built on open standards (not proprietary)
• Forward-compatible with future improvements
• Backward-compatible with password authentication
• Long-term viability ensured by industry backing
  
  
  

Compatible with NopCommerce 4.80.

How to install and configure the plugin.