INTROL Logs

The authenticator generates a new public/private key pair; the private key stays sealed on the device, and only the public key (inside an attestation object) is sent to the relying party. * WebAuthn registration: the device keeps the private key, sends only the public key. * The...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Advantages: phishing-resistant, no shared secret to steal, great login experience. Disadvantages: hardware dependency and portability/integration challenges. Weighing it up against passwords and cookies: Advantages Security — no shared secret transmitted or stored; the private k...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

It calls the API and presents the Access Token in the request's Authorization header; the API validates the token and, if the scopes allow, returns the data. Once the app has obtained the access token (the preceding step of the flow), it makes the "magic API call" — the last two...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The challenge is a fresh random value the authenticator must sign; signing it proves possession of the private key right now and blocks replay attacks. This is classic challenge-response authentication: The server (relying party) issues a random, single-use challenge. The authen...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A passkey is the consumer-friendly name for a FIDO2/WebAuthn credential — a per-account public/private key pair generated and stored by your device, used to log in by signing a challenge instead of typing a password. "Passkey" is the marketing term Apple, Google, Microsoft and th...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

IDaaS means outsourcing login/identity management to a cloud provider; federated identity means one set of credentials at a trusted provider logs you into many independent applications. IDaaS (Identity-as-a-Service): instead of building and securing your own auth (registration, p...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

rp identifies the website the credential belongs to (its ID/domain) — binding each credential to one origin is what makes WebAuthn phishing-resistant. The rp field names the relying party (e.g. id: "webauthn.io"). The credential the authenticator creates is scoped to that relying...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Logging in needs two things at once: possession of the device that holds the private key (factor 1) plus a local PIN or biometric to unlock it (factor 2) — so a single tap already combines "something you have" and "something you are/know." A passkey login feels like one step, but...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

WebAuthn replaces the shared-secret password with public-key cryptography, so there is no password to phish, reuse, guess, or steal from a server breach. As of the FS26 source, passwords were still the most common login method despite glaring weaknesses — "123456" and "password"...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

pubKeyCredParams is the relying party's ordered list of acceptable public-key algorithms; alg: -7 is the COSE identifier for ES256 (ECDSA with the P-256 curve and SHA-256). When the relying party requests a credential, it lists which signature algorithms it will accept in pubKeyC...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026