Passwordless TYPO3 backend authentication via Passkeys (WebAuthn/FIDO2) Passwordless TYPO3 backend authentication via Passkeys (WebAuthn/FIDO2)

2 likes

nr_passkeys_be / stable

by Netresearch

This version supports TYPO3

12 LTS 13 LTS 14 LTS

Older versions also support TYPO3

12 LTS 13 LTS 14 LTS

Tags

Get started

Download 1.0.1

Resources

Extension Manual Found an Issue? Code Insights Packagist.org

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
30. Sep 2026
First upload
10. Feb 2026
Downloads
18,654
Category
Backend
Dependencies
  • PHP (>=8.2.0 <=8.99.99)
  • TYPO3 (>=12.4.0 <=14.99.99)
  • backend (>=12.4.0 <=14.99.99)
  • setup (>=12.4.0 <=14.99.99)

Last upload comment

• chore(release): v1.0.1 (#160)
• ci: sync with netresearch/.github templates/typo3-extension (#159)
• fix(backend): follow the TYPO3 light and dark scheme in module markup (#157)
• ci: run the JavaScript unit tests (#158)
• chore: refresh .bestpractices.json with tightened evidence (#156)
• chore: add .bestpractices.json with evidence-backed badge answers (#155)
• ci: sync with netresearch/.github templates/typo3-extension (#154)

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases

Downloads by month

Installation

  1. Download ZIP file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the ZIP file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.
  1. Go to your folder where the root composer.json file is located
  2. Type: composer require netresearch/nr-passkeys-be to get the latest version that runs on your TYPO3 version.
  1. Download T3X file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the T3X file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.

Other extensions by this user (19)

Version history

Filter for TYPO3 versions

1.0.1 stable Latest
September 30, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
• chore(release): v1.0.1 (#160)
• ci: sync with netresearch/.github templates/typo3-extension (#159)
• fix(backend): follow the TYPO3 light and dark scheme in module markup (#157)
• ci: run the JavaScript unit tests (#158)
• chore: refresh .bestpractices.json with tightened evidence (#156)
• chore: add .bestpractices.json with evidence-backed badge answers (#155)
• ci: sync with netresearch/.github templates/typo3-extension (#154)

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
1.0.0 stable
September 20, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
• chore(release): v1.0.0 (#151)
• test(e2e): run the seven disabled tests again, and fix what they hid (#153)
• ci: run the end-to-end suite in CI (#152)
• ci: exclude test code from SonarCloud duplication detection (#150)
• ci: make the unpinned-PHPUnit PHPStan pass blocking (#149)
• test: allow PHPUnit 12 and 13 (#148)
• ci: sync with netresearch/.github templates/typo3-extension (#147)
• chore(dependabot): remove the Dependabot configuration (#146)
• chore(ast-edit): run PHPStan over the project, not over the changed files (#139)
• chore(deps): update dependency @playwright/test to v1.63.0 (#140)
• chore(ast-edit): declare the PHPStan check so apply runs it (#138)
• chore(cgl): declare the formatter, and pin the printer at v0.5.0 (#137)
• ci(cgl): gate the canonical declaration (#136)
• chore(cgl): declare the repository canonical, and gate it (#135)
• chore(cgl): what the code base looks like after the formatting rules and an AST re-print (#134)
• chore(cgl): reject the space before declare's parentheses (#133)
• test(e2e): give the unknown-user ceremony the same ten seconds as its sibling (#132)
• test(e2e): fix the assertions a working environment showed to be wrong (#131)
• fix(login): bound the conditional-UI re-arm instead of retrying forever (#130)
• fix(test): give -s e2e a TYPO3 to run against again (#128)
• ci: adopt the shared test runner (#126)
• ci: sync checks.yml from the org template (#124)
• docs(agents): sync AGENTS.md files and adopt agent-harness verification (#123)
• ci: pin harden-runner v2.21.0, matching the template (#121)
• Adopt the shared Renovate preset (#117)
• feat(registration): record whether a passkey is discoverable (#119)

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.12.1 beta
August 07, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
• chore(release): v0.12.1 (#118)
• fix(login): keep the passkey autofill ceremony usable and stop the false failure (#116)
• Point CODEOWNERS at a team that exists (#115)
• Assert the exact learn-more URL instead of a substring (#114)
• ci: sync checks.yml gate job from the org template (#111)
• chore(deps): allow the composer-normalize plugin (#108)
• feat(rector): add the TYPO3 v13 level set (#110)
• ci: sync checks.yml gate job from the org template (#109)
• ci: upload coverage to Codecov again (#107)
• feat(rector): enable rector with the shared org config (#106)
• docs: state the commit-signing requirement where contributors look (#105)
• style(test): name the positional parameters in the ddev hook test (#104)
• ci: sync labeler fork-PR fix from typo3-extension template (#103)
• chore(zizmor): drop the local policy copy, the reusable supplies it (#102)
• docs: sync the scanner wording from the template (#101)
• ci: drop the deprecated GITLEAKS_LICENSE secret mapping (#100)
• ci: add gitleaks and zizmor scanners to checks.yml (#99)
• fix(login): stop decoy credential IDs from encoding their own shape (#98)
• test(ddev): cover the ref-name sanitization in CI (#97)
• chore: exclude development files from the release archive (#96)
• fix(controller): return 400 instead of crashing on a non-UTF-8 request body (#95)
• fix(ddev): treat git ref names as untrusted in the local dev tooling (#94)
• fix: address nine security-scan findings (switch-user escalation, Sudo Mode, token expiry, enumeration oracles) (#93)

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.12.0 beta
July 24, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- feat(dashboard): unify passkey dashboard widgets (backend extension point) (#92)
- test: dedupe new dashboard-widget test arrangement
- feat(dashboard): consolidate passkey widgets into one unified widget set

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.11.0 beta
July 23, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.11.0 (#91)
- chore: release v0.11.0
- feat(login): AJAX verify + login token + WebAuthn Signal API (BE) (#90)
- refactor(login): clear remaining SonarCloud reliability + return-count
- refactor(login): fix SonarCloud reliability + smells on the verify flow
- feat(login): AJAX verify + login token + WebAuthn Signal API
- feat(login): conditional UI (autofill) for the backend passkey login (#88)
- feat(login): conditional UI (autofill) for the backend passkey login

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.10.3 beta
July 22, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- fix(docs): repair guides.xml and add docs render CI (#87)
- fix(docs): repair guides.xml and add docs render CI

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.10.2 beta
July 21, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.10.2 (#86)
- chore: release v0.10.2
- feat(dashboard): add passkey adoption and credential-count widgets (#85)
- feat: v14 three-color icons and light/dark scheme support for backend surfaces (#84)
- fix(dashboard): count only credentials of active backend users
- feat(dashboard): add passkey adoption and credential-count widgets
- refactor(tests): deduplicate interstitial scheme test setup
- fix(ui): make backend surfaces adapt to the v14 light/dark schemes
- feat(icons): redraw all icons to the TYPO3 v14 three-color icon style

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.10.1 beta
July 21, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.10.1 (#83)
- chore: release v0.10.1
- fix(log): write passkey audit log to the project var path (#82)
- fix(log): write passkey audit log to the project var path

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.10.0 beta
June 25, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore(release): v0.10.0 (#81)
- chore(release): v0.10.0
- fix(ratelimit): close rate-limit check/record TOCTOU with atomic consume (#80)
- fix(admin): enforce system-maintainer boundary on passkey admin API (#78)
- fix: narrow interstitial AJAX exemption + fail closed on Host-derived rpId/origin (#79)
- fix(auth): enforce discoverableLoginEnabled on the auth-service login path (#77)
- test(ratelimit): clarify consume-rate-limit tests and ordering
- fix(ratelimit): close rate-limit check/record TOCTOU with atomic consume
- fix(config): only enforce host-trust when a request Host header is present
- test+docs: review follow-ups for host-binding and interstitial scope
- fix(config): fail closed when deriving rpId/origin from an untrusted Host
- fix(middleware): narrow interstitial AJAX exemption to enrollment routes
- fix(auth): enforce discoverableLoginEnabled on the auth-service login path
- fix(admin): normalize system-maintainer IDs without a string callable
- refactor(admin): dedupe maintainer-guard literal and tests (SonarCloud)
- fix(admin): extend system-maintainer guard to reminder/clear-nudge endpoints
- fix(admin): enforce system-maintainer boundary on passkey admin API
- ci: adopt canonical typo3-extension template (#71)
- ci: ignore Django CSRF false-positive on Fluid template
- refactor(js): share WebAuthn base64 helpers + modernize login to ES module (TEST-1) (#76)
- refactor(js): share WebAuthn base64 helpers, modernize login to an ES module (TEST-1)
- refactor(service): split WebAuthnService into attestation + assertion ceremonies (ARCH-2) (#75)
- fix(admin): dashboard infobox rendering + i18n + real documentation screenshots (#74)
- refactor(service): split WebAuthnService into attestation + assertion ceremonies
- feat(i18n): make the admin Help page fully translatable
- feat(i18n): make dashboard onboarding infoboxes translatable
- docs: replace plac

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.9.4 beta
June 08, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore(release): v0.9.4 (#69)
- chore(release): v0.9.4
- feat(backend): use FIDO passkey mark for module and login icon (#68)
- style(backend): use SVG presentation attributes in v14 module icon
- style(backend): make v14 module icon duotone with NR-teal key
- feat(backend): use FIDO passkey mark for module and login icon
- test(e2e): target the backend module iframe by id (#67)
- test(e2e): target the backend module iframe by id

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.9.3 beta
May 28, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.9.3 (#65)
- chore: release v0.9.3
- test(setup): cover v14 panel FormEngine wiring + assert E2E render (#64)
- test(setup): cover v14 panel FormEngine wiring + assert E2E render

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.9.0 beta
May 03, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- release: v0.9.0 (#58)
- release: v0.9.0
- chore: support TYPO3 14.3 LTS (incl. webauthn-lib 5.3 migration) (#57)
- refactor: replace deprecated GeneralUtility::getIndpEnv() with NormalizedParams
- ci: grant actions:read to reusable workflow callers
- chore(deps): raise web-auth/webauthn-lib floor to ^5.3
- chore(typo3): bump TYPO3 14.x baseline to ^14.3 LTS
- refactor(webauthn): migrate to web-auth/webauthn-lib 5.3 CredentialRecord API

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.8.2 beta
April 23, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.8.2 (#56)
- chore: release v0.8.2
- fix(docs): replace Documentation/CLAUDE.md symlink with real file (unblocks Intercept render) (#55)
- fix(docs): replace Documentation/CLAUDE.md symlink with file copy

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.8.1 beta
April 23, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
- chore: release v0.8.1 (#54)
- chore(changelog): fix workflow path + cross-repo PR references
- chore: release v0.8.1
- chore: adopt release-typo3-extension orchestrator (#53)
- docs(workflows): update AGENTS.md to reflect orchestrator adoption
- chore: adopt release-typo3-extension orchestrator

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.8.0 beta
April 23, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
## Changes
- chore: release v0.8.0 (#52)
- chore: release v0.8.0
- feat(auth): add skipMfaOnPasskeyAuth to resolve MFA-policy dilemma (#50)
- test(e2e): fixme own mfa-bypass spec pending rpId infra fix
- ci: pick up typo3-ci-workflows npm lockfile fix
- ci: trigger fresh run to pick up typo3-ci-workflows cms-install fix
- ci: trigger fresh run to pick up typo3-ci-workflows e2e fix
- fix(config): defensive fallback for skipMfaOnPasskeyAuth
- test(functional): enable BypassFinals in functional bootstrap
- test(e2e): Playwright coverage for MFA bypass during passkey login
- test(auth): functional test for MFA session-key round-trip
- feat(auth): add skipMfaOnPasskeyAuth setting (default enabled)
- test(e2e): triage 6 pre-existing broken specs with .fixme() (#51)
- test(e2e): triage pre-existing broken specs with .fixme()

## Installation

```bash
composer require netresearch/nr-passkeys-be
```

## Security

All release artifacts are signed with [Sigstore](https://www.sigstore.dev/) keyless signing.

### Verify signatures

```bash
cosign verify-blob \
--bundle nr-passkeys-be-0.8.0.zip.bundle \
--certificate-identity-regexp "https://github.com/netresearch/.*" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
nr-passkeys-be-0.8.0.zip
```

### Verify checksums

```bash
sha256sum -c checksums.txt
```

## Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.

For details see https://github.com/netresearch/t3x-nr-passkeys-be/releases
Download
0.6.0 beta
March 01, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
Features

- Per-group passkey enforcement with 4 levels: Off, Encourage, Required, Enforced
- Configurable grace periods for Required enforcement (1–365 days)
- PSR-15 interstitial middleware prompting users to register passkeys (skippable during grace period, mandatory after expiry)
- Encourage-stage dismissible banner with passkey explanation, docs link, and administrator contact guidance (supports TYPO3 v12/v13/v14)
- Admin dashboard backend module (Admin Tools Passkey Management) with adoption statistics, per-group enforcement controls, and user list
- Admin actions: Send Reminder (nudge), Clear Nudge, Revoke All
- `EnforcementLevel` enum, `EnforcementStatus` DTO, `EnforcementService`, `AdoptionStatsService`
- `PasskeyBanner.js`, `PasskeyDashboard.js` JavaScript modules
- TCA fields `passkey_enforcement` and `passkey_grace_period_days` on `be_groups`
- 5 new admin AJAX endpoints for enforcement and nudge management
- 153 i18n translation units across 4 XLF files
- Context-sensi

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/v0.6.0
Download
0.5.0 beta
February 25, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
Features

- Per-user password login enforcement: `disablePasswordLogin` now blocks passwords only for users who have registered passkeys, enabling gradual onboarding without locking out new users ([25](https://github.com/netresearch/t3x-nr-passkeys-be/pull/25))
- Deployment Scenarios documentation: new chapter covering multi-environment setup, database sync, user onboarding, shared rpId considerations, containerized deployments, and local DDEV development ([26](https://github.com/netresearch/t3x-nr-passkeys-be/pull/26))

Architecture Decision Records

- [ADR-0001](https://github.com/netresearch/t3x-nr-passkeys-be/blob/main/docs/adr/0001-per-user-password-enforcement.md): Per-user password enforcement decision
- [ADR-0002](https://github.com/netresearch/t3x-nr-passkeys-be/blob/main/docs/adr/0002-no-rpid-aware-enforcement.md): No rpId-aware enforcement (security rationale)

Upgrade notes

- `disablePasswordLogin` behavior changed: previously a no-op global kill-switch, now enforces pe

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/0.5.0
Download
0.4.1 beta
February 18, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
Security

- Harden challenge nonce replay protection — nonce verification now uses atomic exclusive locking to prevent TOCTOU race conditions; error responses genericized to avoid leaking internal state (18)

Documentation

- Production deployment security requirements — new documentation section covering trusted hosts pattern, reverse proxy IP detection, and multi-server cache backend configuration (19)

Dependencies

- Update `saschaegerer/phpstan-typo3` from 2.0 to 3.0 (16, dev-only)

Full Changelog: https://github.com/netresearch/t3x-nr-passkeys-be/compare/0.4.0...0.4.1

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/0.4.1
Download
0.4.0 beta
February 16, 2026
TYPO3: 12 LTS 13 LTS 14 LTS (>=12.4.0 <=14.99.99)
What's New

- TYPO3 12.4 LTS support — the extension now supports TYPO3 v12.4 through v14.x (PHP 8.2)
- Event listener registered via Services.yaml tag for v12 compatibility
- FormEngine DI-aware `PasskeyInfoElement` with `setData()` for v12 `NodeFactory`
- CI matrix expanded to 40 jobs covering all three TYPO3 LTS versions
- DDEV development environment includes v12 installation

Other Changes

- OpenSSF Scorecard improved from 6.3 to 9 (14)
- JavaScript tests added to CI (13)
- Dependency updates: CodeQL action bumps (15)

Full Changelog: https://github.com/netresearch/t3x-nr-passkeys-be/compare/0.3.0...0.4.0

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/0.4.0
Download
0.3.0 beta
February 12, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
What's Changed

Refactor
- Use TYPO3 native JS APIs in PasskeyManagement (11) — Replaced custom IIFE with ES module using TYPO3's `AjaxRequest`, `Notification`, `Modal`, `SeverityEnum`, `sudoModeInterceptor`, and `DocumentService`. Fixes sudo mode rendering in v14 iframe.

Features
- Inline name input for passkey registration (12) — Users can now name their passkey before registering it. Input field next to the "Add Passkey" button with accessible `aria-label`, disabled during registration, and reset after success.

Fixes
- Escape label in removal modal (XSS prevention)
- Defer DOM initialization with `DocumentService.ready()`
- Resolve `AjaxRequest` responses and check status before showing success
- Replace inline style with CSS class

Full Changelog: https://github.com/netresearch/t3x-nr-passkeys-be/compare/0.2.0...0.3.0

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/0.3.0
Download
0.1.1 beta
February 10, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
Patch release for TER publishing.

- Fix ext_emconf.php compatibility with TER (remove declare strict_types)
- Fix PHPStan route attribute mapping for CI
- Fix user settings screenshot showing correct Account security tab
- Updated documentation with card-grids, screenshots, current architecture

Details: https://github.com/netresearch/t3x-nr-passkeys-be/releases/tag/0.1.1
Download

Get started

Download 1.0.1

Resources

Extension Manual Found an Issue? Code Insights Packagist.org

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
30. Sep 2026
First upload
10. Feb 2026
Downloads
18,654
Category
Backend
Dependencies
  • PHP (>=8.2.0 <=8.99.99)
  • TYPO3 (>=12.4.0 <=14.99.99)
  • backend (>=12.4.0 <=14.99.99)
  • setup (>=12.4.0 <=14.99.99)