Passkeys Frontend Authentication Passkeys Frontend Authentication

2 likes

nr_passkeys_fe / stable

Passkey-first TYPO3 frontend authentication for fe_users (WebAuthn/FIDO2). Enables passwordless login with TouchID, FaceID, YubiKey, Windows Hello. By Netresearch.

This version supports TYPO3

13 LTS 14 LTS

Older versions also support TYPO3

13 LTS 14 LTS

Tags

Get started

Download 2.0.0

Resources

Extension Manual Found an Issue? Code Insights Packagist.org

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
30. Sep 2026
First upload
23. Mar 2026
Downloads
4,086
Category
Frontend
Dependencies
  • PHP (>=8.2.0 <=8.99.99)
  • nr_passkeys_be (>=1.0.0 <=1.99.99)
  • TYPO3 (>=13.4.0 <=14.99.99)
  • frontend (>=13.4.0 <=14.99.99)
  • backend (>=13.4.0 <=14.99.99)
  • extbase (>=13.4.0 <=14.99.99)
  • fluid (>=13.4.0 <=14.99.99)

Last upload comment

• chore(release): v2.0.0 (#88)
• chore(release): v2.0.0
• docs: link ADR-011 from the events page by document (#87)
• docs: link ADR-011 from the events page by document
• fix: remove or wire the remaining settings nothing read (#85)
• fix: leave an expired grace period alone, test the reset binding
• test(js): cover the reset grace period button
• test(js): drop the redirect tests and isSameOrigin with the branch
• test(e2e): seed the enforcement groups clear of the backend spec's group
• fix: start the grace period before the page renders, add its reset
• refactor(enrollment): split resolveStatus() into smaller steps
• fix: follow the passkey count, the site setting and calendar grace days
• fix: show the real enforcement state on the enrollment page, drop dead listener output
• fix: address the SonarCloud findings on the shared partial and success block
• fix: share the login assets, remove unreachable templates and dead links
• fix: remove or wire the remaining settings nothing read
• fix: show the plugin FlexForms and make the login settings take effect (#84)
• test: pin the resolver's context isolation and shortcut edge cases
• fix: let core decide which login pages a visitor may reach
• fix: judge login targets by their rootline, run the hosted E2E in CI
• fix: link only standard pages as login target and password page
• fix(login): keep login targets on the site, link members-only redirects
• refactor(login): split the page resolver, drop networkidle waits
• fix(login): make the login plugin's FlexForm settings take effect
• fix(tca): show the plugin FlexForms in the content element form
• ci: sync with netresearch/.github templates/typo3-extension (#86)
• ci: sync with netresearch/.github templates/typo3-extension
• test: drive the shipped modules instead of copies of their logic (#82)
• test: close the gaps the review of the real-module tests found
• test(js

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases

Downloads by month

Installation

  1. Download ZIP file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the ZIP file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.
  1. Go to your folder where the root composer.json file is located
  2. Type: composer require netresearch/nr-passkeys-fe to get the latest version that runs on your TYPO3 version.
  1. Download T3X file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the T3X file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.

Other extensions by this user (20)

Version history

Filter for TYPO3 versions

2.0.0 stable Latest
September 30, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
• chore(release): v2.0.0 (#88)
• chore(release): v2.0.0
• docs: link ADR-011 from the events page by document (#87)
• docs: link ADR-011 from the events page by document
• fix: remove or wire the remaining settings nothing read (#85)
• fix: leave an expired grace period alone, test the reset binding
• test(js): cover the reset grace period button
• test(js): drop the redirect tests and isSameOrigin with the branch
• test(e2e): seed the enforcement groups clear of the backend spec's group
• fix: start the grace period before the page renders, add its reset
• refactor(enrollment): split resolveStatus() into smaller steps
• fix: follow the passkey count, the site setting and calendar grace days
• fix: show the real enforcement state on the enrollment page, drop dead listener output
• fix: address the SonarCloud findings on the shared partial and success block
• fix: share the login assets, remove unreachable templates and dead links
• fix: remove or wire the remaining settings nothing read
• fix: show the plugin FlexForms and make the login settings take effect (#84)
• test: pin the resolver's context isolation and shortcut edge cases
• fix: let core decide which login pages a visitor may reach
• fix: judge login targets by their rootline, run the hosted E2E in CI
• fix: link only standard pages as login target and password page
• fix(login): keep login targets on the site, link members-only redirects
• refactor(login): split the page resolver, drop networkidle waits
• fix(login): make the login plugin's FlexForm settings take effect
• fix(tca): show the plugin FlexForms in the content element form
• ci: sync with netresearch/.github templates/typo3-extension (#86)
• ci: sync with netresearch/.github templates/typo3-extension
• test: drive the shipped modules instead of copies of their logic (#82)
• test: close the gaps the review of the real-module tests found
• test(js

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
1.0.1 stable
September 21, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
• chore(release): v1.0.1 (#71)
• chore(release): v1.0.1
• test(e2e): run the passkey flows in CI, and fix the three defects that blocked them (#70)
• fix(login): give every username-first answer the same time budget
• test(e2e): hold the first test until the instance answers
• test(login): pin the properties the decoy options rest on
• docs(agents): describe how the e2e suite actually runs
• ci: run the e2e suite against TYPO3 13 and 14
• test(e2e): drive the real passkey flows against a provisioned TYPO3
• fix(login): carry the login token through a TYPO3-rendered form
• fix(admin): pass integer states to the infobox view helper
• fix(login): answer an unknown username with decoy options

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
1.0.0 stable
September 20, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
• chore(release): v1.0.0 (#69)
• chore(release): v1.0.0
• fix: work with nr_passkeys_be 1.0 and find credentials on SQLite (#67)
• chore(deps): require nr_passkeys_be 1.0
• fix(rate-limit)!: call consumeRateLimit(), the method that still exists
• fix(repository): bind the binary columns by their schema type
• ci: sync with netresearch/.github templates/typo3-extension (#66)
• ci: sync with netresearch/.github templates/typo3-extension
• chore(dependabot): remove the Dependabot configuration (#65)
• chore(dependabot): remove the Dependabot configuration
• chore(deps): update step-security/harden-runner action to v2.21.1 (#63)
• chore(deps): update step-security/harden-runner action to v2.21.1
• ci: adopt the shared test runner (#62)
• ci: let the composer scripts take CI's extra arguments
• ci: call the shared runner with -s from the composer scripts
• ci: adopt the shared test runner
• ci: sync checks.yml from the org template (#60)
• ci: sync checks.yml from the org template
• docs(agents): sync AGENTS.md files and adopt agent-harness verification (#59)
• docs(agents): sync AGENTS.md files and adopt agent-harness verification
• chore(deps): update step-security/harden-runner action to v2.21.0 (#57)
• chore(deps): update step-security/harden-runner action to v2.21.0
• Extend the shared Renovate preset (#54)
• chore: extend the shared Renovate preset

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.6.0 beta
August 07, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
• chore(release): v0.6.0 (#56)
• chore(release): v0.6.0
• feat(login): arm the WebAuthn conditional-UI ceremony the docs promise (#55)
• fix(tests): drop the defects ordering the result cache cannot serve
• docs: document the login plugin's discoverable switch and its autofill effect
• feat(login): arm the WebAuthn conditional-UI ceremony the docs promise
• ci: sync checks.yml gate job from the org template (#51)
• ci: sync checks.yml from the org template (codeql auto, gate docs)
• feat(rector): add the TYPO3 v13 level set (#50)
• feat(rector): add the TYPO3 v13 level set
• feat: register plugins as CType on both supported TYPO3 versions (#47)
• Merge branch 'main' into feature/45-register-plugins-as-ctype
• chore(deps): update step-security/harden-runner action to v2.20.1 (#49)
• Merge branch 'main' into feature/45-register-plugins-as-ctype
• chore(deps): update step-security/harden-runner action to v2.20.1
• ci: sync checks.yml gate job from the org template (#48)
• ci: sync checks.yml gate job from the org template
• feat: register plugins as CType on both supported TYPO3 versions
• feat(rector): enable rector with the shared org config (#43)
• Merge remote-tracking branch 'origin/main' into feat/enable-rector
• chore(deps): drop dev-dependencies the shared package already provides (#46)
• test: cover the code paths left uncovered by the rector diff
• chore(deps): drop dev-dependencies the shared package already provides
• chore(rector): settle the merged tree on the fixpoint
• Merge remote-tracking branch 'origin/main' into feat/enable-rector
• test: re-enable the functional and integration suites in CI (#44)
• fix(test): carry the extension lists in a base class, not a trait
• test: re-enable the functional and integration suites in CI
• test: extract the shared QueryBuilder stub into one trait
• test: declare the real interface as closure return type, not Stub

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.5.0 beta
July 24, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- feat(dashboard): contribute frontend passkey stats to the unified BE widget set (#34)
- feat(dashboard): contribute frontend passkey stats to the unified BE widget set

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.4.0 beta
July 23, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.4.0 (#33)
- chore(deps): allow nr-passkeys-be ^0.11
- chore: release v0.4.0
- feat(login): report unknown credentials via the WebAuthn Signal API (#32)
- feat(login): report unknown credentials via the WebAuthn Signal API

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.5 beta
July 22, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.3.5 (#31)
- chore: release v0.3.5
- fix(backend): move admin module to Site Management group (#30)
- fix(backend): move the admin module to the Site Management group

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.4 beta
July 22, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- fix(docs): repair guides.xml and add docs render CI (#29)
- fix(docs): repair guides.xml and add docs render CI

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.3 beta
July 21, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.3.3 (#28)
- chore: release v0.3.3
- feat(dashboard): add admin-only passkey adoption and credential widgets (#27)
- fix: COUNT(DISTINCT) crash in admin module + v14 icon refresh (#26)
- feat(dashboard): add admin-only passkey adoption and credential widgets
- feat(icons): align icon set with nr-passkeys-be motif and v14 dark mode
- fix(service): use selectLiteral for COUNT(DISTINCT) aggregations

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.2 beta
July 21, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.3.2 (#25)
- chore: release v0.3.2
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8 || ^0.9 || ^0.10 (#24)
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8 || ^0.9 || ^0.10
- ci: adopt canonical typo3-extension template (#23)
- ci: adopt netresearch/.github typo3-extension template

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.1 beta
June 12, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.3.1 (#22)
- chore: release v0.3.1

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.3.0 beta
June 12, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
- chore: release v0.3.0 (#21)
- fix(docs): bump guides.xml release attribute to 0.3.0
- fix(phpstan): correct per-group stats key type, bump guides.xml version
- chore: release v0.3.0
- fix(sast): suppress two Opengrep false positives with rationale (#20)
- fix(sast): suppress two Opengrep false positives with rationale
- fix: address CSRF, webauthn-lib 5.3 compat, and PHPUnit 12 warnings (#19)
- refactor(enrollment): remove dead canSkip query parameter
- fix(enrollment): remove dead skip-form block from enrollment template
- fix(tests): silence PHPUnit 12 coverage-target warnings under failOnWarning
- fix(webauthn): migrate to CredentialRecord for webauthn-lib 5.3
- fix(security): use TYPO3 native CSRF protection on enrollment skip form
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8 || ^0.9 (#18)
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8 || ^0.9
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8 (#17)
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 || ^0.8
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7 (#16)
- fix(deps): update dependency netresearch/nr-passkeys-be to ^0.6 || ^0.7
- fix: remove empty secrets blocks and fix YAML syntax
- chore: remove explicit gitleaks call, now handled by org-wide default
- fix: add permissions to gitleaks job, remove stale secret from security job
- feat: add direct gitleaks call from netresearch/.github
- fix: use @main for .github reusable workflows, not SHA pin
- chore: migrate generic workflows from typo3-ci-workflows to .github
- fix(ci): pass extra args (coverage flags) through runTests.sh to PHPUnit
- fix(ci): broaden deprecated pattern to catch class + method deprecations
- fix(ci): suppress request attribute + short ternary PHPStan violations
- fix(ci): match ergebnis

For details see https://github.com/netresearch/t3x-nr-passkeys-fe/releases
Download
0.2.0 beta
March 24, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.20 <=14.99.99)
## v0.2.0 — First Beta Release

Passkey-first frontend authentication for TYPO3 fe_users via WebAuthn/FIDO2. This is the first fully functional beta with working passkey login, recovery code login, and complete DDEV demo environment.

### Highlights

- **Working passkey login** via token-based session establishment (eID verifies assertion → cache token → felogin form → auth service → FE session)
- **Recovery code login** using the same token mechanism
- **Password login** with felogin integration (passkey button injected via template override)
- **DDEV demo environment** with 4 provisioned pages, demo user (demo/demo), and both TYPO3 v13 + v14

### Quality

- 568 tests (323 unit + 168 fuzz + 77 JS), zero notices/deprecations
- PHPStan level 10, zero errors
- 7 PSR-14 events, all dispatched
- 8 services with SRP (FrontendUserLookupService extracted)
- 8 JS modules with shared PasskeyUtils.js (URL builder, base64url, DOM helpers)
- Full i18n: 62+ XLIFF keys, all templates localized
- WCAG 2.1 AA: focus indicators, keyboard tab navigation, ARIA, contrast

### Security

- Token-based auth: one-time cache tokens with 120s TTL
- HMAC-signed challenges with nonce replay protection
- Per-IP rate limiting and account lockout
- WebAuthn UV=REQUIRED for both registration and authentication
- No `secrets: inherit` in any workflow

### Breaking Changes from v0.1.x

- `MagicLinkRequestedEvent` removed (deferred to future release per ADR-011)
- `ext_tables.sql` now explicitly declares `fe_users`/`fe_groups` columns
- `PasskeyUtils.js` must be loaded before other JS modules (priority loading)

### For Integrators

```bash
composer require netresearch/nr-passkeys-fe:^0.2
```

Requires `netresearch/nr-passkeys-be` ^0.6. See [Documentation](https://docs.typo3.org/p/netresearch/nr-passkeys-fe/main/en-us/) for configuration.
Download
0.1.0 alpha
March 23, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
Passkey-First Frontend Authentication for TYPO3

Initial release of `nr_passkeys_fe` — native, passwordless login for TYPO3 frontend users via WebAuthn/FIDO2 passkeys.

Features

- Passkey-first login with discoverable credentials (no username required)
- Tabbed login UI: Passkey tab (default) Password tab via felogin template override
- Standalone passkey plugin for passkey-only login pages
- Recovery codes (bcrypt hashed, XXXX-XXXX format, single-use)
- Per-site per-group enforcement (Off / Encourage / Required / Enforced)
- Post-login enrollment interstitial middleware with grace periods
- Backend admin module with adoption dashboard and credential management
- Self-service passkey management plugin (register, rename, remove passkeys)
- 8 PSR-14 events for extensibility (enrollment, auth, recovery, enforcement)
- Multi-site support with per-site RP ID and storage PID credential isolation
- FIDO Alliance passkey icon (industry standard)
- felogin integration via template overri

Details: https://github.com/netresearch/t3x-nr-passkeys-fe/releases/tag/v0.1.0
Download

Get started

Download 2.0.0

Resources

Extension Manual Found an Issue? Code Insights Packagist.org

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
30. Sep 2026
First upload
23. Mar 2026
Downloads
4,086
Category
Frontend
Dependencies
  • PHP (>=8.2.0 <=8.99.99)
  • nr_passkeys_be (>=1.0.0 <=1.99.99)
  • TYPO3 (>=13.4.0 <=14.99.99)
  • frontend (>=13.4.0 <=14.99.99)
  • backend (>=13.4.0 <=14.99.99)
  • extbase (>=13.4.0 <=14.99.99)
  • fluid (>=13.4.0 <=14.99.99)