Symfony: What You Need to Know About Passkey Management and Account Recovery

In Part 1 and Part 2, we built a fortress. We implemented WebAuthn, gracefully handled hybrid password fallbacks, and created a frictionless login experience using Conditional UI (autofill) Part 1 Part 1 Part 2 Part 2 WebAuthn Conditional UI But now we must face the nightmare scenario: The Lost Device. The Lost Device When you eliminate passwords, a user’s smartphone or YubiKey becomes their only key to the castle. If that device is lost, stolen, or destroyed, how do they get back in? If we just email them a magic link, we instantly downgrade our security model back to the vulnerabilities of email interception. Today, we are building a bulletproof account recovery and passkey management system. We will create a user dashboard to manage active credentials, implement a “Last Used” tracker, and generate cryptographically secure, one-time recovery codes using the web-authn/web-authn-symfony-bundle. “Last Used” authn/web-authn-symfony-bundle. Grab a coffee. We are diving deep into Symfony events, Doctrine lifecycle callbacks, WebAuthn v5 quirks, and clean architecture. The Architecture of Recovery Before we write code, let’s define the architecture of a production-ready WebAuthn recovery system: Transparency (The Dashboard): Users must be able to see all their registered passkeys, including when they were created and last used. Revocation: Users must be able to delete a passkey. If a device is stolen, revoking the credential instantly neutralizes the threat. The Fallback (Recovery Codes): Instead of passwords or email links, we will generate a set of one-time use, offline recovery codes during registration. These act as the ultimate fallback. Transparency (The Dashboard): Users must be able to see all their registered passkeys, including when they were created and last used. Transparency (The Dashboard): Revocation: Users must be able to delete a passkey. If a device is stolen, revoking the credential instantly neutralizes the threat. Revocation: The Fallback (Recovery Codes): Instead of passwords or email links, we will generate a set of one-time use, offline recovery codes during registration. These act as the ultimate fallback. The Fallback (Recovery Codes): Building the Passkey Management Dashboard To allow users to manage their passkeys, we need to query the database for their registered credentials. If you followed the standard bundle setup, you already have a PublicKeyCredentialSource Doctrine entity and repository. PublicKeyCredentialSource Let’s create a controller to list and delete these credentials. namespace App\Controller;

use App\Repository\PublicKeyCredentialSourceRepository; use Doctrine\ORM\EntityManagerInterface; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; use Symfony\Component\Security\Http\Attribute\IsGranted;

use App\Service\RecoveryCodeGenerator;

#[IsGranted('ROLE_USER')] #[Route('/settings/passkeys', name: 'app_settings_passkeys_')] class PasskeyManagementController extends AbstractController { public function __construct( private readonly PublicKeyCredentialSourceRepository $credentialRepository, private readonly EntityManagerInterface $entityManager ) {}

#[Route('/', name: 'index', methods: ['GET'])] public function index(RecoveryCodeGenerator $generator): Response { /** @var \App\Entity\User $user */ $user = $this->getUser();

$newCodes = []; if ($user->getRecoveryCodes()->isEmpty()) { $newCodes = $generator->generateForUser($user, 10); }

// We map our Symfony User to the WebAuthn User Entity $userEntity = $user->toWebAuthnUser();

// Fetch all passkeys bound to this user $credentials = $this->credentialRepository->findAllForUserEntity($userEntity);

return $this->render('settings/passkeys/index.html.twig', [ 'credentials' => $credentials, 'newCodes' => $newCodes, ]); }

#[Route('/{id}/revoke', name: 'revoke', methods: ['POST'])] public function revoke(string $id): Response { $credential = $this->credentialRepository->findOneBy(['id' => $id]);

// Security Check: Ensure the credential belongs to the currently logged-in user if (!$credential || $credential->userHandle !== (string) $this->getUser()->getUserHandle()) { throw $this->createAccessDeniedException('You cannot revoke this passkey.'); }

$this->entityManager->remove($credential); $this->entityManager->flush();

$this->addFlash('success', 'Passkey successfully revoked.');

return $this->redirectToRoute('app_settings_passkeys_index'); } } namespace App\Controller;