passkeys and login sessions

Welcome!

dnproto is an atproto PDS that I'm writing in C#. I'll be posting occasional updates about the project.

The project sources are currently hosted at GitHub -> https://github.com/threddyrex/dnproto

I host my main account using the software. As I encounter bugs (or missing features) I implement them.

Below are some updates from this week. ⬇️

Update 1: passkey support

I've completed what I would consider "version 0.1" of passkey support in the dnproto PDS. Namely these two scenarios:

Registering a new passkey with the PDS.

Using the passkey during authentication.

I think many (most?) implementations of passkeys group these two scenarios together, but I decided to split them apart, to make it easier for me to understand.

For registering new passkeys, I added a page to the Admin Dashboard:

You just hit that "Add Passkey" button and then complete the flow in the browser. You can store the passkey on your device or in your password manager.

For the second scenario - using the passkey during authentication - things were a little more complicated. Bluesky controls the main login flow with username and password, so I couldn't use passkeys for that. But I added it in two other places:

Logging in to ATProto apps using OAuth

Logging in to the Admin Dashboard

For example - I used a passkey when logging in to Leaflet to publish this post!

I didn't expect to use this feature much, but I'm finding that I authenticate with passkeys all the time now.

Update 2: managing login sessions

I get nervous when granting access to my account via OAuth. I added a page on the dashboard to track and manage authenticated sessions:

(sorry for all of the masked values lol)

This page has the following three tables:

Legacy Sessions - sessions where I logged in to Bluesky using username and password

OAuth Sessions - sessions where I logged in to another app using OAuth

Admin Sessions - sessions for the Admin Dashboard

With this page, I can quickly delete sessions after using them. I'll do this for my Leaflet session today.