Changelog 

Version 0.5.0 

Unified passkey dashboard widgets

Breaking / Important 

  • Standalone dashboard widgets removed -- nr_passkeys_fe no longer registers its own Passkey adoption and Active passkey credentials dashboard widgets. When both extensions are installed the dashboard previously showed four near-identical widgets; it now shows the single unified widget set owned by nr_passkeys_be.
  • Frontend adoption is now a segment of the unified widgets -- Frontend statistics appear as the "Frontend users" segment (a second doughnut ring and a summed credential count) of the nr_passkeys_be widgets, contributed via the new nr_passkeys_be.adoption_stats_provider service tag (FrontendPasskeyAdoptionStatsProvider). Backend and frontend user populations are shown separately, never summed.
  • Requires netresearch/nr-passkeys-be ^0.12 -- the extension point (PasskeyAdoptionStatsProviderInterface and the PasskeyAudienceStats DTO) is provided from nr_passkeys_be 0.12.0. The Composer constraint and the ext_emconf.php dependency were tightened accordingly.
  • TYPO3 v13 compatibility shim removed -- nr_passkeys_fe no longer references any typo3/cms-dashboard symbol, so the AdminOnlyWidgetInterface compat shim (and its autoload.files entry) has been dropped.

Version 0.1.0 

Initial release

This is the first public release of Passkeys Frontend Authentication (nr_passkeys_fe). It provides passkey-first login for TYPO3 frontend users with all core features.

Features 

  • Passkey-first login -- Discoverable (usernameless) and username-first login flows via the NrPasskeysFe:Login plugin. Supports all FIDO2/WebAuthn-compliant authenticators.
  • felogin integration -- Injects a passkey button into the standard felogin plugin via PSR-14 event listener. No login provider switching required.
  • Self-service management -- Frontend users can enroll, rename, and revoke their own passkeys via the NrPasskeysFe:Management plugin.
  • Recovery codes -- Users can generate 10 one-time recovery codes (bcrypt hashed) as a fallback when no authenticator device is available.
  • Per-site RP ID -- Each TYPO3 site has an independent WebAuthn Relying Party configuration via config.yaml.
  • Per-group enforcement -- Four enforcement levels (Off, Encourage, Required, Enforced) configurable per site and per frontend user group with configurable grace periods.
  • Post-login interstitial -- Users without a passkey are shown an enrollment interstitial when enforcement level is Required or Enforced.
  • Backend admin module -- Administrators can view adoption statistics, manage credentials, and configure enforcement from Admin Tools > Passkey Management FE.
  • PSR-14 events -- Seven events for extensibility: before/after authentication, before/after enrollment, enforcement level resolved, passkey removed, recovery codes generated.
  • Security hardened -- HMAC-signed challenges, nonce replay protection, per-IP rate limiting, and account lockout (shared with nr-passkeys-be).
  • Vanilla JavaScript -- Zero runtime npm dependencies. The frontend JavaScript uses only the native WebAuthn browser API.

Requirements 

  • TYPO3 13.4 LTS or 14.1+
  • PHP 8.2+
  • netresearch/nr-passkeys-be ^0.6
  • HTTPS

Known limitations 

  • Magic link login is deferred to v0.2 (ADR-011). The event class and service will be added in v0.2.
  • No admin-initiated passkey registration on behalf of users.