{"id":498160,"date":"2026-10-11T10:57:56","date_gmt":"2026-10-11T07:57:56","guid":{"rendered":"https:\/\/savepearlharbor.com\/?p=498160"},"modified":"2026-10-11T10:57:56","modified_gmt":"2026-10-11T07:57:56","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=498160","title":{"rendered":"Passkeys \u0432 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u043d\u0435: \u043a\u0430\u043a \u043c\u044b \u0432\u044b\u043a\u0438\u043d\u0443\u043b\u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 Face ID \u0437\u0430 3 \u0434\u043d\u044f. FastAPI + Next.js, \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u0434"},"content":{"rendered":"<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\n<p>Passkeys \u2014 \u044d\u0442\u043e \u043d\u0435 \u0431\u0443\u0434\u0443\u0449\u0435\u0435. \u042d\u0442\u043e \u0443\u0436\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0435. \u0410\u043b\u044c\u0444\u0430-\u0411\u0430\u043d\u043a, \u0422\u0438\u043d\u044c\u043a\u043e\u0444\u0444, \u0421\u0431\u0435\u0440 \u2014 \u0434\u0430\u0432\u043d\u043e. GitHub, Apple, Google \u2014 \u0442\u043e\u0436\u0435. \u0410 \u0432\u0430\u0448 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0441\u0438\u0442 \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u0441 \u0437\u0430\u0433\u043b\u0430\u0432\u043d\u043e\u0439 \u0431\u0443\u043a\u0432\u043e\u0439, \u0446\u0438\u0444\u0440\u043e\u0439 \u0438 \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u043c. \u0418 \u043f\u043e\u0442\u043e\u043c \u0435\u0449\u0451 \u00ab\u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c\u00bb \u0440\u0430\u0437 \u0432 \u043c\u0435\u0441\u044f\u0446.<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/3f\/0a\/4b\/3f0a4b80f7fe2000cce6eb22f238d1c8.png\" width=\"1560\" height=\"880\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/3f\/0a\/4b\/3f0a4b80f7fe2000cce6eb22f238d1c8.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/3f\/0a\/4b\/3f0a4b80f7fe2000cce6eb22f238d1c8.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/figure>\n<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u042f\u0440\u043e\u0441\u043b\u0430\u0432 \u041c\u043e\u0440\u043e\u0437\u043e\u0432, \u044f \u0441\u0442\u0440\u043e\u044e Continental \u2014 IT-\u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433 \u0438 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u0438\u0448\u0443 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442. \u041a\u043e\u0433\u0434\u0430 \u0434\u043e\u0448\u043b\u0438 \u0434\u043e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0440\u0435\u0448\u0438\u043b\u0438 \u043d\u0435 \u043c\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 Passkeys. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u0449\u0435, \u0447\u0435\u043c \u044f \u0434\u0443\u043c\u0430\u043b.<\/p>\n<p>\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u2014 \u043f\u043e\u043b\u043d\u044b\u0439 production-\u043a\u043e\u0434. \u041e\u0442 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0434\u043e \u043a\u043d\u043e\u043f\u043a\u0438 \u00ab\u0412\u043e\u0439\u0442\u0438 \u043f\u043e Face ID\u00bb. FastAPI \u043d\u0430 \u0431\u044d\u043a\u0435, Next.js \u043d\u0430 \u0444\u0440\u043e\u043d\u0442\u0435. \u041c\u043e\u0436\u043d\u043e \u0432\u0437\u044f\u0442\u044c \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c.<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/c8\/4e\/a8\/c84ea8bc86b762b67d47273658601cd4.png\" width=\"2400\" height=\"1578\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/c8\/4e\/a8\/c84ea8bc86b762b67d47273658601cd4.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/c8\/4e\/a8\/c84ea8bc86b762b67d47273658601cd4.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/figure>\n<h3>\u0417\u0430\u0447\u0435\u043c \u0432\u043e\u043e\u0431\u0449\u0435 Passkeys<\/h3>\n<p>\u041a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u043e\u0442\u0432\u0435\u0442 \u2014 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u0438 \u0443\u0434\u043e\u0431\u043d\u0435\u0435. \u0414\u043b\u0438\u043d\u043d\u044b\u0439:<\/p>\n<div>\n<div class=\"table\">\n<table>\n<tbody>\n<tr>\n<th>\n<p align=\"left\">\n<\/th>\n<th>\n<p align=\"left\">\u041f\u0430\u0440\u043e\u043b\u0438<\/p>\n<\/th>\n<th>\n<p align=\"left\">Passkeys<\/p>\n<\/th>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><strong>\u0424\u0438\u0448\u0438\u043d\u0433<\/strong><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0430 \u0444\u0435\u0439\u043a\u043e\u0432\u043e\u043c \u0441\u0430\u0439\u0442\u0435<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d \u2014 \u043a\u043b\u044e\u0447 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a \u0434\u043e\u043c\u0435\u043d\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><strong>\u0423\u0442\u0435\u0447\u043a\u0438 \u0411\u0414<\/strong><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0425\u0435\u0448\u0438 bcrypt \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0442\u044c \u043c\u0435\u0441\u044f\u0446\u0430\u043c\u0438. \u0418\u043b\u0438 \u043d\u0435 \u043c\u043e\u0436\u043d\u043e, \u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0431\u0443\u044e\u0442<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u043d\u0435 \u043f\u043e\u043a\u0438\u0434\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0412 \u0411\u0414 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><strong>UX<\/strong><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c, \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u0432\u0432\u0435\u0441\u0442\u0438. \u0417\u0430\u0431\u044b\u043b \u2014 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0439<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0430\u043b\u0435\u0446 \u043d\u0430 \u0441\u043a\u0430\u043d\u0435\u0440 \u0438\u043b\u0438 \u0432\u0437\u0433\u043b\u044f\u0434 \u0432 \u043a\u0430\u043c\u0435\u0440\u0443. \u0412\u0441\u0451<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><strong>\u041f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435<\/strong><\/p>\n<\/td>\n<td>\n<p align=\"left\">65% \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0434\u0438\u043d \u043f\u0430\u0440\u043e\u043b\u044c \u0432\u0435\u0437\u0434\u0435<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0423\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0430\u0440\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>Passkeys \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435\u043c\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438:<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/93\/60\/48\/936048e0128774dc162cef31e04ddf97.png\" width=\"2400\" height=\"1524\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/93\/60\/48\/936048e0128774dc162cef31e04ddf97.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/93\/60\/48\/936048e0128774dc162cef31e04ddf97.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/figure>\n<p>\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c FIDO Alliance, \u0431\u043e\u043b\u0435\u0435 15 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 passkeys. Google, Apple, Microsoft \u2014 \u0432\u0441\u0435 \u0442\u0440\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u2014 \u0432\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u041e\u0421.<\/p>\n<p>\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 Passkeys \u2014 \u044d\u0442\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0430 <strong>WebAuthn<\/strong> (W3C) \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 <strong>FIDO2<\/strong>. \u041d\u043e \u0432\u0430\u043c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 200 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0437\u0430 \u0432\u0430\u0441 90% \u0440\u0430\u0431\u043e\u0442\u044b.<\/p>\n<h3>\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442<\/h3>\n<h4>\u041d\u0430 \u043f\u0430\u043b\u044c\u0446\u0430\u0445<\/h4>\n<p>Passkey \u2014 \u044d\u0442\u043e \u043f\u0430\u0440\u0430 \u0430\u0441\u0438\u043c\u043c\u0435\u0442\u0440\u0438\u0447\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439:<\/p>\n<ul>\n<li>\n<p><strong>\u041f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u043a\u043b\u044e\u0447<\/strong> \u0436\u0438\u0432\u0451\u0442 \u0432 Secure Enclave \u0432\u0430\u0448\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u042d\u0442\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0447\u0438\u043f, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0434\u0430\u0436\u0435 \u041e\u0421 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041a\u043b\u044e\u0447 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u043f\u043e\u043a\u0438\u0434\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e.<\/p>\n<\/li>\n<li>\n<p><strong>\u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447<\/strong> \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0411\u0414.<\/p>\n<\/li>\n<\/ul>\n<p>\u041f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 <strong>challenge<\/strong> (32 \u0431\u0430\u0439\u0442\u0430). \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c (\u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0431\u0438\u043e\u043c\u0435\u0442\u0440\u0438\u0435\u0439). \u0421\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c.<\/p>\n<p>\u0412\u0441\u0451. \u041f\u0430\u0440\u043e\u043b\u044c \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0435\u0433\u043e \u043d\u0435\u0442.<\/p>\n<h4>\u0421\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438<\/h4>\n<p>\u0421\u043e\u0437\u0434\u0430\u043b\u0438 passkey \u043d\u0430 iPhone \u2014 \u043e\u043d \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u044f\u0432\u0438\u0442\u0441\u044f \u043d\u0430 MacBook \u0447\u0435\u0440\u0435\u0437 iCloud Keychain. \u0421\u043e\u0437\u0434\u0430\u043b\u0438 \u043d\u0430 Android \u2014 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 Google Password Manager. \u042d\u0442\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f <strong>Discoverable Credentials<\/strong> \u2014 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0441\u0430\u043c\u043e \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438 \u0435\u0441\u0442\u044c \u0434\u043b\u044f \u043a\u0430\u043a\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430.<\/p>\n<h4>\u0421\u0432\u044f\u0437\u044c \u0441 JWT<\/h4>\n<p>\u0412\u0430\u0436\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442: Passkeys <strong>\u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u044e\u0442<\/strong> JWT. \u041e\u043d\u0438 \u0437\u0430\u043c\u0435\u043d\u044f\u044e\u0442 <strong>\u0432\u0432\u043e\u0434 \u043b\u043e\u0433\u0438\u043d\u0430-\u043f\u0430\u0440\u043e\u043b\u044f<\/strong>. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 passkey \u0431\u044d\u043a\u0435\u043d\u0434 \u0432\u044b\u0434\u0430\u0451\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 JWT-\u0442\u043e\u043a\u0435\u043d\u044b (access + refresh), \u0438 \u0434\u0430\u043b\u044c\u0448\u0435 \u0432\u0441\u0451 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0440\u0430\u043d\u044c\u0448\u0435. \u041d\u0435 \u043d\u0430\u0434\u043e \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u0432\u0441\u044e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e.<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/05\/ff\/09\/05ff099ca3406a8288c57571c3ce1dc7.png\" alt=\"\u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f Passkey\" title=\"\u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f Passkey\" width=\"2400\" height=\"2304\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/05\/ff\/09\/05ff099ca3406a8288c57571c3ce1dc7.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/05\/ff\/09\/05ff099ca3406a8288c57571c3ce1dc7.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f Passkey<\/figcaption><\/div>\n<\/figure>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/0a\/8d\/0a\/0a8d0a6f7f5b31eeee9592739bfae85d.png\" alt=\"\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\" title=\"\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\" width=\"2400\" height=\"2508\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/0a\/8d\/0a\/0a8d0a6f7f5b31eeee9592739bfae85d.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/0a\/8d\/0a\/0a8d0a6f7f5b31eeee9592739bfae85d.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f<\/figcaption><\/div>\n<\/figure>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/d9\/1f\/a2\/d91fa23a8bc177878ff5fb935558ca07.png\" alt=\"\u041e\u0431\u0449\u0430\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 (\u0447\u0442\u043e \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0433\u0434\u0435)\" title=\"\u041e\u0431\u0449\u0430\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 (\u0447\u0442\u043e \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0433\u0434\u0435)\" width=\"2400\" height=\"2600\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/d9\/1f\/a2\/d91fa23a8bc177878ff5fb935558ca07.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/d9\/1f\/a2\/d91fa23a8bc177878ff5fb935558ca07.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u041e\u0431\u0449\u0430\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 (\u0447\u0442\u043e \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0433\u0434\u0435)<\/figcaption><\/div>\n<\/figure>\n<h3>\u0421\u0442\u0435\u043a \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438<\/h3>\n<p>\u041c\u0438\u043d\u0438\u043c\u0443\u043c \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0414\u0432\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043f\u043e\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0432\u0441\u0451:<\/p>\n<p><strong>Backend (Python):<\/strong><\/p>\n<pre><code class=\"bash\">pip install webauthn&gt;=2.0.0<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper\"><\/span><\/a><\/div><\/pre>\n<p><code>py-webauthn<\/code> \u2014 \u0437\u0440\u0435\u043b\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0430\u0432\u0442\u043e\u0440 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WebAuthn. \u0413\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442 challenge, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u0432\u0435\u0442\u044b, \u043f\u0430\u0440\u0441\u0438\u0442 CBOR. \u0411\u0435\u0437 \u043d\u0435\u0451 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0431\u044b \u0440\u0443\u043a\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u043c\u0438 \u2014 \u043f\u043e\u0432\u0435\u0440\u044c\u0442\u0435, \u043d\u0435 \u0445\u043e\u0442\u0438\u0442\u0435.<\/p>\n<p><strong>Frontend (TypeScript):<\/strong><\/p>\n<pre><code class=\"bash\">npm install @simplewebauthn\/browser @simplewebauthn\/types<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p><code>SimpleWebAuthn<\/code> \u2014 \u043e\u0431\u0451\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 <code>navigator.credentials<\/code>. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c: \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0443\u0435\u0442 ArrayBuffer \u2194 base64url \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438. \u041a\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0441 WebCrypto API, \u0437\u043d\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u0431\u043e\u043b\u044c \u2014 \u0431\u0435\u0441\u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 <code>btoa()<\/code>, <code>Uint8Array<\/code>, <code>TextEncoder<\/code>. SimpleWebAuthn \u0443\u0431\u0438\u0440\u0430\u0435\u0442 \u0432\u0441\u0451 \u044d\u0442\u043e.<\/p>\n<h3>\u0411\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445<\/h3>\n<p>\u0414\u0432\u0435 \u0442\u0430\u0431\u043b\u0438\u0446\u044b. \u0412\u0441\u0451.<\/p>\n<h4>webauthn_credentials \u2014 \u0445\u0440\u0430\u043d\u0438\u0442 \u043a\u043b\u044e\u0447\u0438<\/h4>\n<pre><code class=\"sql\">CREATE TABLE webauthn_credentials (    id              UUID        PRIMARY KEY DEFAULT gen_random_uuid(),    user_id         UUID        NOT NULL REFERENCES users(id) ON DELETE CASCADE,    credential_id   BYTEA       NOT NULL UNIQUE,    public_key      BYTEA       NOT NULL,    sign_count      INTEGER     DEFAULT 0,    transports      VARCHAR(255),    device_name     VARCHAR(100),    created_at      TIMESTAMPTZ DEFAULT now(),    last_used_at    TIMESTAMPTZ);CREATE INDEX ix_webauthn_cred_credential_id ON webauthn_credentials(credential_id);CREATE INDEX ix_webauthn_cred_user_id ON webauthn_credentials(user_id);<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u0427\u0442\u043e \u0442\u0443\u0442 \u0447\u0442\u043e:<\/p>\n<ul>\n<li>\n<p><code><strong>credential_id<\/strong><\/code> (BYTEA) \u2014 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0439 ID \u043a\u043b\u044e\u0447\u0430, \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c. \u041f\u043e \u043d\u0435\u043c\u0443 \u0438\u0449\u0435\u043c credential \u043f\u0440\u0438 \u043b\u043e\u0433\u0438\u043d\u0435. \u0412 API \u0445\u043e\u0434\u0438\u0442 \u043a\u0430\u043a base64url-\u0441\u0442\u0440\u043e\u043a\u0430, \u0432 \u0411\u0414 \u043b\u0435\u0436\u0438\u0442 \u043a\u0430\u043a raw bytes.<\/p>\n<\/li>\n<li>\n<p><code><strong>public_key<\/strong><\/code> (BYTEA) \u2014 COSE-\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447. \u0418\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.<\/p>\n<\/li>\n<li>\n<p><code><strong>sign_count<\/strong><\/code> \u2014 \u0441\u0447\u0451\u0442\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0438\u043d\u043a\u0440\u0435\u043c\u0435\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0438 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438. \u0415\u0441\u043b\u0438 \u043f\u0440\u0438\u0448\u0451\u043b sign_count \u043c\u0435\u043d\u044c\u0448\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u043e\u0433\u043e \u2014 \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043b\u044e\u0447. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 \u00ab\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u00bb.<\/p>\n<\/li>\n<li>\n<p><code><strong>transports<\/strong><\/code> \u2014 JSON-\u043c\u0430\u0441\u0441\u0438\u0432: <code>[\"internal\"]<\/code> \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 (Face ID, Touch ID), <code>[\"usb\"]<\/code> \u0434\u043b\u044f YubiKey, <code>[\"hybrid\"]<\/code> \u0434\u043b\u044f QR-code flow. \u041f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0443 \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0439 UI.<\/p>\n<\/li>\n<li>\n<p><code><strong>device_name<\/strong><\/code> \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u0442\u044c \u043a\u043b\u044e\u0447: \u00abiPhone \u0440\u0430\u0431\u043e\u0442\u0430\u00bb, \u00abMacBook \u0434\u043e\u043c\u00bb. \u0427\u0438\u0441\u0442\u043e \u0434\u043b\u044f UX.<\/p>\n<\/li>\n<\/ul>\n<h4>webauthn_challenges \u2014 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0435 challenge<\/h4>\n<pre><code class=\"sql\">CREATE TABLE webauthn_challenges (    id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),    user_id     UUID        REFERENCES users(id) ON DELETE CASCADE,    challenge   BYTEA       NOT NULL,    created_at  TIMESTAMPTZ DEFAULT now());<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>Challenge \u0436\u0438\u0432\u0451\u0442 5 \u043c\u0438\u043d\u0443\u0442. \u041f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u2014 \u0443\u0434\u0430\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0437 \u0411\u0414. \u041e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439, \u043a\u0430\u043a OTP.<\/p>\n<p><code>user_id<\/code> nullable \u2014 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0437\u043d\u0430\u0435\u043c, \u043a\u0442\u043e \u043b\u043e\u0433\u0438\u043d\u0438\u0442\u0441\u044f (discoverable credentials), \u043f\u043e\u044d\u0442\u043e\u043c\u0443 challenge \u0441\u043e\u0437\u0434\u0430\u0451\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.<\/p>\n<p><strong>\u041f\u043e\u0447\u0435\u043c\u0443 PostgreSQL, \u0430 \u043d\u0435 Redis?<\/strong> \u0414\u043b\u044f challenge-\u0435\u0439 \u0445\u0432\u0430\u0442\u0430\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0439 \u0442\u0430\u0431\u043b\u0438\u0446\u044b. \u0418\u0445 \u043c\u0430\u043b\u043e (1 challenge \u043d\u0430 1 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043b\u043e\u0433\u0438\u043d\u0430), \u043e\u043d\u0438 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0435 (32 \u0431\u0430\u0439\u0442\u0430 + \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435), \u0436\u0438\u0432\u0443\u0442 \u043d\u0435\u0434\u043e\u043b\u0433\u043e. \u0415\u0441\u043b\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u044b\u0440\u0430\u0441\u0442\u0435\u0442 \u2014 \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0432 Redis \u0437\u0430 15 \u043c\u0438\u043d\u0443\u0442, API \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u0441\u044f.<\/p>\n<h4>SQLAlchemy-\u043c\u043e\u0434\u0435\u043b\u0438<\/h4>\n<pre><code class=\"python\">import uuidfrom datetime import datetimefrom sqlalchemy import DateTime, ForeignKey, Integer, LargeBinary, String, funcfrom sqlalchemy.dialects.postgresql import UUIDfrom sqlalchemy.orm import Mapped, mapped_column, relationshipclass WebAuthnCredential(Base):    __tablename__ = \"webauthn_credentials\"    id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4,    )    user_id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True),        ForeignKey(\"users.id\", ondelete=\"CASCADE\"),        nullable=False,    )    credential_id: Mapped[bytes] = mapped_column(        LargeBinary, unique=True, index=True, nullable=False,    )    public_key: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)    sign_count: Mapped[int] = mapped_column(Integer, default=0)    transports: Mapped[str | None] = mapped_column(String(255), nullable=True)    device_name: Mapped[str | None] = mapped_column(String(100), nullable=True)    created_at: Mapped[datetime] = mapped_column(        DateTime(timezone=True), server_default=func.now(),    )    last_used_at: Mapped[datetime | None] = mapped_column(        DateTime(timezone=True), nullable=True,    )    user: Mapped[\"User\"] = relationship(back_populates=\"webauthn_credentials\")class WebAuthnChallenge(Base):    __tablename__ = \"webauthn_challenges\"    id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4,    )    user_id: Mapped[uuid.UUID | None] = mapped_column(        UUID(as_uuid=True),        ForeignKey(\"users.id\", ondelete=\"CASCADE\"),        nullable=True,    )    challenge: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)    created_at: Mapped[datetime] = mapped_column(        DateTime(timezone=True), server_default=func.now(),    )<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u0412 \u043c\u043e\u0434\u0435\u043b\u0438 <code>User<\/code> \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c relationship:<\/p>\n<pre><code class=\"python\">class User(Base):    # ... \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044f ...    webauthn_credentials: Mapped[list[\"WebAuthnCredential\"]] = relationship(        back_populates=\"user\",        cascade=\"all, delete-orphan\",  # \u0423\u0434\u0430\u043b\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u2014 \u0443\u0434\u0430\u043b\u0438\u043b\u0438\u0441\u044c \u0435\u0433\u043e \u043a\u043b\u044e\u0447\u0438    )<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h3>Backend: \u043f\u043e\u043b\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441<\/h3>\n<h4>\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f<\/h4>\n<p>\u0422\u0440\u0438 env-\u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435:<\/p>\n<pre><code># \u0414\u043e\u043c\u0435\u043d \u0441\u0430\u0439\u0442\u0430 \u2014 \u0431\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430, \u0431\u0435\u0437 \u043f\u043e\u0440\u0442\u0430WEBAUTHN_RP_ID=example.com# \u0418\u043c\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0432\u0438\u0434\u0438\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0434\u0438\u0430\u043b\u043e\u0433\u0435 Face IDWEBAUTHN_RP_NAME=My App# \u041f\u043e\u043b\u043d\u044b\u0439 URL \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438WEBAUTHN_RP_ORIGIN=https:\/\/example.com<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u0414\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438:<\/p>\n<pre><code>WEBAUTHN_RP_ID=localhostWEBAUTHN_RP_NAME=My App DevWEBAUTHN_RP_ORIGIN=http:\/\/localhost:3000<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>Pydantic Settings:<\/p>\n<pre><code class=\"python\">from pydantic_settings import BaseSettingsclass Settings(BaseSettings):    # ... \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 ...    webauthn_rp_id: str = \"localhost\"    webauthn_rp_name: str = \"My App\"    webauthn_rp_origin: str = \"http:\/\/localhost:3000\"settings = Settings()<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a<\/h4>\n<p>\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u044c \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u2014 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f:<\/p>\n<pre><code class=\"python\">from fastapi import HTTPExceptionclass AuthException(HTTPException):    \"\"\"\u0411\u0430\u0437\u043e\u0432\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043e\u043a \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\"\"\"    def __init__(self, detail: str, status_code: int = 400):        super().__init__(status_code=status_code, detail=detail)class WebAuthnError(AuthException):    \"\"\"400 \u2014 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0440\u043e\u0442\u0443\u0445\u0448\u0438\u0439 challenge \u0438 \u0442.\u0434.\"\"\"    def __init__(self, detail: str = \"WebAuthn error\"):        super().__init__(detail=detail, status_code=400)class PasskeyNotFoundError(AuthException):    \"\"\"404 \u2014 passkey \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d \u0438\u043b\u0438 \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.\"\"\"    def __init__(self):        super().__init__(detail=\"Passkey not found\", status_code=404)class UserNotFoundError(AuthException):    \"\"\"404 \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d.\"\"\"    def __init__(self):        super().__init__(detail=\"User not found\", status_code=404)class UserNotActiveError(AuthException):    \"\"\"403 \u2014 \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0434\u0435\u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d.\"\"\"    def __init__(self):        super().__init__(detail=\"User account is deactivated\", status_code=403)<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>WebAuthnService \u2014 \u0432\u0435\u0441\u044c \u0441\u0435\u0440\u0432\u0438\u0441<\/h4>\n<p>\u0412\u043e\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441. \u041a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u0448\u0430\u0433\u0435 \u2014 \u0447\u0442\u043e\u0431\u044b \u0431\u044b\u043b\u043e \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438 \u0437\u0430\u0447\u0435\u043c:<\/p>\n<pre><code class=\"python\">\"\"\"WebAuthn \/ Passkeys \u2014 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 FIDO2.\"\"\"import jsonimport uuidfrom datetime import UTC, datetime, timedeltafrom sqlalchemy import delete, selectfrom sqlalchemy.ext.asyncio import AsyncSessionfrom sqlalchemy.orm import selectinloadfrom webauthn import (    generate_authentication_options,    generate_registration_options,    verify_authentication_response,    verify_registration_response,)from webauthn.helpers import bytes_to_base64url, options_to_jsonfrom webauthn.helpers.structs import (    AuthenticatorSelectionCriteria,    AuthenticatorTransport,    PublicKeyCredentialDescriptor,    ResidentKeyRequirement,    UserVerificationRequirement,)CHALLENGE_TTL_MINUTES = 5def _parse_transports(raw: str | None) -&gt; list[AuthenticatorTransport]:    \"\"\"JSON-\u0441\u0442\u0440\u043e\u043a\u0430 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043e\u0432 \u2192 enum-\u044b py-webauthn.\"\"\"    if not raw:        return []    try:        return [AuthenticatorTransport(t) for t in json.loads(raw)]    except (ValueError, KeyError):        return []class WebAuthnService:    def __init__(self, db: AsyncSession):        self.db = db    # \u2500\u2500 Challenge management \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500    async def _save_challenge(        self, challenge: bytes, user_id: uuid.UUID | None = None,    ) -&gt; uuid.UUID:        \"\"\"\u0421\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c challenge \u0432 \u0411\u0414, \u0432\u0435\u0440\u043d\u0443\u0442\u044c UUID \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043d\u0430 \u0444\u0440\u043e\u043d\u0442.\"\"\"        ch = WebAuthnChallenge(user_id=user_id, challenge=challenge)        self.db.add(ch)        await self.db.flush()        return ch.id    async def _pop_challenge(self, challenge_id: uuid.UUID) -&gt; bytes:        \"\"\"        \u0418\u0437\u0432\u043b\u0435\u0447\u044c challenge \u0438 \u0441\u0440\u0430\u0437\u0443 \u0443\u0434\u0430\u043b\u0438\u0442\u044c. \u041e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439.        \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 TTL \u2014 \u0435\u0441\u043b\u0438 \u043f\u0440\u043e\u0448\u043b\u043e \u0431\u043e\u043b\u044c\u0448\u0435 5 \u043c\u0438\u043d\u0443\u0442, \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0435\u043c.        \"\"\"        result = await self.db.execute(            select(WebAuthnChallenge).where(WebAuthnChallenge.id == challenge_id)        )        ch = result.scalar_one_or_none()        if not ch:            raise WebAuthnError(\"Challenge not found or expired\")        cutoff = datetime.now(UTC) - timedelta(minutes=CHALLENGE_TTL_MINUTES)        if ch.created_at.replace(tzinfo=UTC) &lt; cutoff:            await self.db.delete(ch)            await self.db.flush()            raise WebAuthnError(\"Challenge expired\")        challenge = ch.challenge        await self.db.delete(ch)  # Pop \u2014 \u0434\u043e\u0441\u0442\u0430\u043b\u0438 \u0438 \u0441\u0440\u0430\u0437\u0443 \u0443\u0434\u0430\u043b\u0438\u043b\u0438        await self.db.flush()        return challenge    async def _get_user_credentials(        self, user_id: uuid.UUID,    ) -&gt; list[WebAuthnCredential]:        result = await self.db.execute(            select(WebAuthnCredential).where(                WebAuthnCredential.user_id == user_id            )        )        return list(result.scalars().all())    # \u2500\u2500 Registration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500    async def generate_registration_options(self, user: User) -&gt; dict:        \"\"\"        \u0428\u0430\u0433 1: \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c challenge \u0438 \u043e\u043f\u0446\u0438\u0438.        exclude_credentials \u2014 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f,        \u0447\u0442\u043e\u0431\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043d\u0435 \u0441\u043e\u0437\u0434\u0430\u043b \u0434\u0443\u0431\u043b\u0438\u043a\u0430\u0442.        \"\"\"        existing = await self._get_user_credentials(user.id)        exclude_credentials = [            PublicKeyCredentialDescriptor(                id=cred.credential_id,                transports=_parse_transports(cred.transports),            )            for cred in existing        ]        options = generate_registration_options(            rp_id=settings.webauthn_rp_id,            rp_name=settings.webauthn_rp_name,            user_id=user.id.bytes,            user_name=user.email,            user_display_name=(                f\"{user.first_name or ''} {user.last_name or ''}\".strip()                or user.email            ),            authenticator_selection=AuthenticatorSelectionCriteria(                # PREFERRED \u2014 \u0441\u043e\u0437\u0434\u0430\u0442\u044c discoverable credential, \u0435\u0441\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e                # \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u0433\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u0432\u0432\u043e\u0434\u0430 email.                resident_key=ResidentKeyRequirement.PREFERRED,                # PREFERRED \u2014 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u0431\u0438\u043e\u043c\u0435\u0442\u0440\u0438\u044e, \u043d\u043e \u043d\u0435 \u043b\u043e\u043c\u0430\u0442\u044c flow \u043d\u0430                # \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0431\u0435\u0437 Face ID \/ Touch ID (\u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d PIN).                user_verification=UserVerificationRequirement.PREFERRED,            ),            exclude_credentials=exclude_credentials,        )        challenge_id = await self._save_challenge(options.challenge, user.id)        await self.db.commit()        # options_to_json() \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0443\u0435\u0442 bytes \u2192 base64url, enum-\u044b \u2192 \u0441\u0442\u0440\u043e\u043a\u0438        options_json = json.loads(options_to_json(options))        # \u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c challengeId \u2014 \u0444\u0440\u043e\u043d\u0442 \u0432\u0435\u0440\u043d\u0451\u0442 \u0435\u0433\u043e \u043d\u0430 \u0448\u0430\u0433\u0435 2        options_json[\"challengeId\"] = str(challenge_id)        return options_json    async def verify_registration(        self,        user: User,        challenge_id: uuid.UUID,        credential: dict,        device_name: str | None = None,    ) -&gt; WebAuthnCredential:        \"\"\"        \u0428\u0430\u0433 2: \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043e\u0442\u0432\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430, \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043a\u043b\u044e\u0447 \u0432 \u0411\u0414.        credential \u2014 JSON-\u043e\u0431\u044a\u0435\u043a\u0442 \u043e\u0442 startRegistration() (SimpleWebAuthn).        py-webauthn \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442: challenge \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442, origin \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442,        RP ID \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442, \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0432\u0430\u043b\u0438\u0434\u043d\u0430.        \"\"\"        challenge = await self._pop_challenge(challenge_id)        try:            verification = verify_registration_response(                credential=credential,                expected_challenge=challenge,                expected_rp_id=settings.webauthn_rp_id,                expected_origin=settings.webauthn_rp_origin,            )        except Exception as e:            raise WebAuthnError(f\"Registration verification failed: {e}\")        transports = credential.get(\"response\", {}).get(\"transports\", [])        cred = WebAuthnCredential(            user_id=user.id,            credential_id=verification.credential_id,            public_key=verification.credential_public_key,            sign_count=verification.sign_count,            transports=json.dumps(transports) if transports else None,            device_name=device_name,        )        self.db.add(cred)        await self.db.commit()        await self.db.refresh(cred)        return cred    # \u2500\u2500 Authentication \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500    async def generate_authentication_options(        self, email: str | None = None,    ) -&gt; dict:        \"\"\"        \u0428\u0430\u0433 1: \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c challenge \u0434\u043b\u044f \u043b\u043e\u0433\u0438\u043d\u0430.        email \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u0435\u043d:        - \u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u043d \u2014 \u0444\u0438\u043b\u044c\u0442\u0440\u0443\u0435\u043c \u043a\u043b\u044e\u0447\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f          (allow_credentials). \u0411\u0440\u0430\u0443\u0437\u0435\u0440 \u043f\u043e\u043a\u0430\u0436\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0433\u043e \u043a\u043b\u044e\u0447\u0438.        - \u0415\u0441\u043b\u0438 \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u043d \u2014 allow_credentials \u043f\u0443\u0441\u0442\u043e\u0439. \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440          \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u0442 \u0432\u0441\u0435 discoverable credentials \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430.          \u042d\u0442\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u00ab\u0432\u0445\u043e\u0434 \u0431\u0435\u0437 \u0432\u0432\u043e\u0434\u0430 email\u00bb.        \"\"\"        allow_credentials = []        if email:            result = await self.db.execute(                select(User).where(User.email == email.lower())            )            user = result.scalar_one_or_none()            if user:                creds = await self._get_user_credentials(user.id)                allow_credentials = [                    PublicKeyCredentialDescriptor(                        id=c.credential_id,                        transports=(                            json.loads(c.transports) if c.transports else []                        ),                    )                    for c in creds                ]        options = generate_authentication_options(            rp_id=settings.webauthn_rp_id,            allow_credentials=(                allow_credentials if allow_credentials else None            ),            user_verification=UserVerificationRequirement.PREFERRED,        )        # \u041f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 user_id = None (\u0435\u0449\u0451 \u043d\u0435 \u0437\u043d\u0430\u0435\u043c \u043a\u0442\u043e \u043b\u043e\u0433\u0438\u043d\u0438\u0442\u0441\u044f)        challenge_id = await self._save_challenge(options.challenge)        await self.db.commit()        options_json = json.loads(options_to_json(options))        options_json[\"challengeId\"] = str(challenge_id)        return options_json    async def verify_authentication(        self,        challenge_id: uuid.UUID,        credential: dict,    ) -&gt; TokenResponse:        \"\"\"        \u0428\u0430\u0433 2: \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044c, \u0432\u044b\u0434\u0430\u0442\u044c JWT.        \u041f\u043e\u0440\u044f\u0434\u043e\u043a:        1. \u0418\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u043c challenge \u0438\u0437 \u0411\u0414 (pop \u2014 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439)        2. \u041d\u0430\u0445\u043e\u0434\u0438\u043c credential \u043f\u043e rawId        3. \u0417\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0440\u043e\u043b\u044f\u043c\u0438        4. \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 py-webauthn        5. \u041e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c sign_count \u0438 last_used_at        6. \u0412\u044b\u0434\u0430\u0451\u043c JWT access + refresh        \"\"\"        challenge = await self._pop_challenge(challenge_id)        # rawId \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043a\u0430\u043a base64url-\u0441\u0442\u0440\u043e\u043a\u0430        raw_id = credential.get(\"rawId\") or credential.get(\"id\")        if not raw_id:            raise WebAuthnError(\"Missing credential ID\")        from webauthn.helpers import base64url_to_bytes        try:            cred_id_bytes = base64url_to_bytes(raw_id)        except Exception:            raise WebAuthnError(\"Invalid credential ID format\")        # \u0418\u0449\u0435\u043c \u0432 \u0411\u0414 \u043f\u043e credential_id (bytes)        result = await self.db.execute(            select(WebAuthnCredential).where(                WebAuthnCredential.credential_id == cred_id_bytes            )        )        stored_cred = result.scalar_one_or_none()        if not stored_cred:            raise WebAuthnError(\"Credential not found\")        # \u0417\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 eager-loading \u0440\u043e\u043b\u0435\u0439 (\u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f JWT payload)        result = await self.db.execute(            select(User)            .options(                selectinload(User.service_roles)                .selectinload(UserServiceRole.service)            )            .where(User.id == stored_cred.user_id)        )        user = result.scalar_one_or_none()        if not user:            raise UserNotFoundError()        if not user.is_active:            raise UserNotActiveError()        # \u0412\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u2014 py-webauthn \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0432\u0441\u0451:        # challenge, origin, RP ID, \u043f\u043e\u0434\u043f\u0438\u0441\u044c, sign_count        try:            verification = verify_authentication_response(                credential=credential,                expected_challenge=challenge,                expected_rp_id=settings.webauthn_rp_id,                expected_origin=settings.webauthn_rp_origin,                credential_public_key=stored_cred.public_key,                credential_current_sign_count=stored_cred.sign_count,            )        except Exception as e:            raise WebAuthnError(f\"Authentication verification failed: {e}\")        # \u041e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c sign_count (\u0434\u043b\u044f \u0434\u0435\u0442\u0435\u043a\u0446\u0438\u0438 \u043a\u043b\u043e\u043d\u043e\u0432) \u0438 last_used_at        stored_cred.sign_count = verification.new_sign_count        stored_cred.last_used_at = datetime.now(UTC)        # \u0412\u044b\u0434\u0430\u0451\u043c JWT \u2014 \u0442\u043e\u0447\u043d\u043e \u0442\u0430\u043a \u0436\u0435, \u043a\u0430\u043a \u043f\u0440\u0438 \u043e\u0431\u044b\u0447\u043d\u043e\u043c \u043b\u043e\u0433\u0438\u043d\u0435 \u043f\u043e \u043f\u0430\u0440\u043e\u043b\u044e        access_token = create_access_token(user.id)        refresh_token, jti, expires_at = create_refresh_token(user.id)        token_record = RefreshToken(            user_id=user.id, jti=jti, expires_at=expires_at,        )        self.db.add(token_record)        await self.db.commit()        return TokenResponse(            access_token=access_token,            refresh_token=refresh_token,            user=UserResponse.from_user(user),        )    # \u2500\u2500 Passkey management \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500    async def get_user_passkeys(        self, user_id: uuid.UUID,    ) -&gt; list[WebAuthnCredential]:        return await self._get_user_credentials(user_id)    async def get_user_passkeys_count(self, user_id: uuid.UUID) -&gt; int:        creds = await self._get_user_credentials(user_id)        return len(creds)    async def rename_passkey(        self,        user_id: uuid.UUID,        credential_id: uuid.UUID,        device_name: str,    ) -&gt; WebAuthnCredential:        result = await self.db.execute(            select(WebAuthnCredential).where(                WebAuthnCredential.id == credential_id,                WebAuthnCredential.user_id == user_id,  # \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430!            )        )        cred = result.scalar_one_or_none()        if not cred:            raise PasskeyNotFoundError()        cred.device_name = device_name        await self.db.commit()        await self.db.refresh(cred)        return cred    async def delete_passkey(        self, user_id: uuid.UUID, credential_id: uuid.UUID,    ) -&gt; None:        result = await self.db.execute(            select(WebAuthnCredential).where(                WebAuthnCredential.id == credential_id,                WebAuthnCredential.user_id == user_id,            )        )        cred = result.scalar_one_or_none()        if not cred:            raise PasskeyNotFoundError()        await self.db.delete(cred)        await self.db.commit()<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>API \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u044b (FastAPI)<\/h4>\n<pre><code class=\"python\">import uuidfrom typing import Annotatedfrom fastapi import APIRouter, Dependsfrom sqlalchemy.ext.asyncio import AsyncSessionfrom pydantic import BaseModel, field_validatorrouter = APIRouter(prefix=\"\/api\/auth\", tags=[\"Authentication\"])# \u2500\u2500 Schemas \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500class PasskeyResponse(BaseModel):    id: uuid.UUID    device_name: str | None = None    created_at: datetime    last_used_at: datetime | None = None    class Config:        from_attributes = Trueclass PasskeyRenameRequest(BaseModel):    device_name: str    @field_validator(\"device_name\")    @classmethod    def validate_name(cls, v: str) -&gt; str:        v = v.strip()        if not v:            raise ValueError(\"Device name cannot be empty\")        if len(v) &gt; 100:            raise ValueError(\"Device name must be at most 100 characters\")        return vclass PasskeyCountResponse(BaseModel):    count: int# \u2500\u2500 Dependency \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500def get_webauthn_service(    db: Annotated[AsyncSession, Depends(get_db)],) -&gt; WebAuthnService:    return WebAuthnService(db)# \u2500\u2500 Registration (auth required) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500@router.post(\"\/passkeys\/register\/options\")async def passkey_register_options(    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    return await service.generate_registration_options(user)@router.post(\"\/passkeys\/register\/verify\", response_model=PasskeyResponse)async def passkey_register_verify(    body: dict,    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    challenge_id = uuid.UUID(body.pop(\"challengeId\"))    device_name = body.pop(\"deviceName\", None)    cred = await service.verify_registration(        user, challenge_id, body, device_name,    )    return PasskeyResponse.model_validate(cred)# \u2500\u2500 Authentication (no auth!) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500@router.post(\"\/passkeys\/authenticate\/options\")async def passkey_auth_options(    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],    body: dict | None = None,):    email = body.get(\"email\") if body else None    return await service.generate_authentication_options(email)@router.post(\"\/passkeys\/authenticate\/verify\", response_model=TokenResponse)async def passkey_auth_verify(    body: dict,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    challenge_id = uuid.UUID(body.pop(\"challengeId\"))    return await service.verify_authentication(challenge_id, body)# \u2500\u2500 Management (auth required) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500@router.get(\"\/passkeys\", response_model=list[PasskeyResponse])async def get_passkeys(    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    creds = await service.get_user_passkeys(user.id)    return [PasskeyResponse.model_validate(c) for c in creds]@router.get(\"\/passkeys\/count\", response_model=PasskeyCountResponse)async def get_passkeys_count(    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    count = await service.get_user_passkeys_count(user.id)    return PasskeyCountResponse(count=count)@router.patch(\"\/passkeys\/{credential_id}\", response_model=PasskeyResponse)async def rename_passkey(    credential_id: uuid.UUID,    data: PasskeyRenameRequest,    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    cred = await service.rename_passkey(        user.id, credential_id, data.device_name,    )    return PasskeyResponse.model_validate(cred)@router.delete(\"\/passkeys\/{credential_id}\")async def delete_passkey(    credential_id: uuid.UUID,    user: CurrentActiveUser,    service: Annotated[WebAuthnService, Depends(get_webauthn_service)],):    await service.delete_passkey(user.id, credential_id)    return {\"message\": \"Passkey deleted\"}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u0418\u0442\u043e\u0433\u043e 8 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u0432:<\/p>\n<div>\n<div class=\"table\">\n<table>\n<tbody>\n<tr>\n<th>\n<p align=\"left\">\u041c\u0435\u0442\u043e\u0434<\/p>\n<\/th>\n<th>\n<p align=\"left\">URL<\/p>\n<\/th>\n<th>\n<p align=\"left\">Auth<\/p>\n<\/th>\n<th>\n<p align=\"left\">\u0417\u0430\u0447\u0435\u043c<\/p>\n<\/th>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">POST<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/register\/options<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">Challenge \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">POST<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/register\/verify<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0421\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">POST<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/authenticate\/options<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041d\u0435\u0442<\/p>\n<\/td>\n<td>\n<p align=\"left\">Challenge \u0434\u043b\u044f \u043b\u043e\u0433\u0438\u043d\u0430<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">POST<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/authenticate\/verify<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041d\u0435\u0442<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043b\u044e\u0447 \u2192 JWT<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">GET<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0421\u043f\u0438\u0441\u043e\u043a \u043a\u043b\u044e\u0447\u0435\u0439<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">GET<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/count<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043b\u044e\u0447\u0435\u0439<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">PATCH<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/{id}<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u0442\u044c<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\">DELETE<\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>\/passkeys\/{id}<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">JWT<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0423\u0434\u0430\u043b\u0438\u0442\u044c<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<h3>Frontend: \u043e\u0442 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043e \u043a\u043d\u043e\u043f\u043a\u0438<\/h3>\n<h4>webauthn.ts \u2014 \u044f\u0434\u0440\u043e<\/h4>\n<pre><code class=\"typescript\">import {  browserSupportsWebAuthn,  startRegistration,  startAuthentication,} from \"@simplewebauthn\/browser\";import { apiClient } from \".\/api-client\";export { browserSupportsWebAuthn };\/\/ \u2500\u2500 \u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500export async function registerPasskey(  deviceName?: string,): Promise&lt;boolean&gt; {  \/\/ 1. \u041f\u043e\u043b\u0443\u0447\u0438\u0442\u044c challenge \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 (\u043d\u0443\u0436\u0435\u043d JWT \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0437\u0430\u043b\u043e\u0433\u0438\u043d\u0435\u043d)  const options = await apiClient.post&lt;Record&lt;string, unknown&gt;&gt;(    \"\/api\/auth\/passkeys\/register\/options\",  );  const challengeId = options.challengeId as string;  \/\/ 2. \u041f\u043e\u043a\u0430\u0437\u0430\u0442\u044c Face ID \/ Touch ID \/ Windows Hello  \/\/    startRegistration() \u2014 \u043e\u0431\u0451\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 navigator.credentials.create()  const credential = await startRegistration({    optionsJSON: options as any,  });  \/\/ 3. \u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043d\u0430 \u0431\u044d\u043a \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438  await apiClient.post(\"\/api\/auth\/passkeys\/register\/verify\", {    ...credential,    challengeId,    deviceName: deviceName || null,  });  return true;}\/\/ \u2500\u2500 \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500interface TokenResponse {  access_token: string;  refresh_token: string;  token_type: string;  user: unknown;}export async function authenticateWithPasskey(  email?: string,): Promise&lt;TokenResponse&gt; {  \/\/ 1. \u041f\u043e\u043b\u0443\u0447\u0438\u0442\u044c challenge (\u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442 \u2014 \u0431\u0435\u0437 JWT)  const options = await apiClient.post&lt;Record&lt;string, unknown&gt;&gt;(    \"\/api\/auth\/passkeys\/authenticate\/options\",    email ? { email } : {},    { skipAuth: true },  );  const challengeId = options.challengeId as string;  \/\/ 2. Face ID \/ Touch ID  \/\/    startAuthentication() \u2014 \u043e\u0431\u0451\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 navigator.credentials.get()  const credential = await startAuthentication({    optionsJSON: options as any,  });  \/\/ 3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430 \u0431\u044d\u043a\u0435 \u2192 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c JWT  const tokenResponse = await apiClient.post&lt;TokenResponse&gt;(    \"\/api\/auth\/passkeys\/authenticate\/verify\",    { ...credential, challengeId },    { skipAuth: true },  );  return tokenResponse;}\/\/ \u2500\u2500 \u041e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043e\u0442\u043c\u0435\u043d\u044b Face ID \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500export function isWebAuthnCancellation(err: Error): boolean {  const msg = err.message || err.name || \"\";  return (    msg.includes(\"NotAllowedError\") ||   \/\/ User denied biometric    msg.includes(\"AbortError\") ||         \/\/ User cancelled dialog    msg.includes(\"cancelled\") ||          \/\/ Safari\/macOS    msg.includes(\"not allowed\") ||        \/\/ Android    msg.includes(\"denied permission\")     \/\/ Firefox  );}\/\/ \u2500\u2500 Quick-login helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\/\/ \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e passkey \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u0438\u043c\u044f \u0438 email \u0432 localStorage.\/\/ \u041f\u0440\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0437\u0430\u0445\u043e\u0434\u0435 \u2014 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \"\u041f\u0440\u0438\u0432\u0435\u0442, \u042f\u0440\u043e\u0441\u043b\u0430\u0432\" \u0432\u043c\u0435\u0441\u0442\u043e \u0444\u043e\u0440\u043c\u044b \u043f\u0430\u0440\u043e\u043b\u044f.const PASSKEY_USER_KEY = \"passkey_user\";export interface PasskeyUser {  name: string;  email: string;}export function savePasskeyUser(name: string, email: string): void {  localStorage.setItem(PASSKEY_USER_KEY, JSON.stringify({ name, email }));}export function getPasskeyUser(): PasskeyUser | null {  try {    const raw = localStorage.getItem(PASSKEY_USER_KEY);    return raw ? JSON.parse(raw) : null;  } catch {    return null;  }}export function clearPasskeyUser(): void {  localStorage.removeItem(PASSKEY_USER_KEY);}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>SWR-\u0445\u0443\u043a\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430\u043c\u0438<\/h4>\n<pre><code class=\"typescript\">import useSWR from \"swr\";import { apiClient } from \"@\/lib\/api-client\";export interface Passkey {  id: string;  device_name: string | null;  created_at: string;  last_used_at: string | null;}const fetcher = &lt;T&gt;(url: string) =&gt; apiClient.get&lt;T&gt;(url);export function usePasskeys() {  const { data, error, isLoading, mutate } = useSWR&lt;Passkey[]&gt;(    \"\/api\/auth\/passkeys\",    fetcher,  );  return { passkeys: data || [], isLoading, error, mutate };}export function usePasskeysCount() {  const { data, error, isLoading, mutate } = useSWR&lt;{ count: number }&gt;(    \"\/api\/auth\/passkeys\/count\",    fetcher,  );  return { count: data?.count ?? 0, isLoading, error, mutate };}export async function renamePasskey(  credentialId: string,  deviceName: string,): Promise&lt;Passkey&gt; {  return apiClient.patch&lt;Passkey&gt;(    `\/api\/auth\/passkeys\/${credentialId}`,    { device_name: deviceName },  );}export async function deletePasskey(credentialId: string): Promise&lt;void&gt; {  await apiClient.delete(`\/api\/auth\/passkeys\/${credentialId}`);}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>\u0418\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 Auth Context<\/h4>\n<p>\u0412 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 auth-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u043e\u0434\u0438\u043d \u043c\u0435\u0442\u043e\u0434:<\/p>\n<pre><code class=\"typescript\">\/\/ auth-context.tsximport { authenticateWithPasskey, savePasskeyUser } from \".\/webauthn\";\/\/ \u0412\u043d\u0443\u0442\u0440\u0438 AuthProvider:const loginWithPasskey = useCallback(  async (email?: string) =&gt; {    const response = await authenticateWithPasskey(email);    \/\/ \u0421\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u0442\u043e\u043a\u0435\u043d\u044b \u2014 \u043a\u0430\u043a \u043f\u0440\u0438 \u043e\u0431\u044b\u0447\u043d\u043e\u043c \u043b\u043e\u0433\u0438\u043d\u0435    setTokens(response.access_token, response.refresh_token);    const user = response.user as User;    \/\/ \u0417\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u043b\u044f quick-login    savePasskeyUser(      user.first_name || user.email.split(\"@\")[0],      user.email,    );    setState({ user, isLoading: false, isAuthenticated: true });  },  [],);<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>Quick Login \u2014 \u044d\u043a\u0440\u0430\u043d \u043a\u0430\u043a \u0432 \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445<\/h4>\n<p>\u042d\u0442\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 UX, \u0440\u0430\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u0441\u0451 \u0437\u0430\u0442\u0435\u0432\u0430\u043b\u043e\u0441\u044c. \u041e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0448\u044c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u2014 \u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u0444\u043e\u0440\u043c\u044b \u043f\u0430\u0440\u043e\u043b\u044f \u0432\u0438\u0434\u0438\u0448\u044c \u00ab\u041f\u0440\u0438\u0432\u0435\u0442, \u042f\u0440\u043e\u0441\u043b\u0430\u0432\u00bb \u0441 \u043a\u043d\u043e\u043f\u043a\u043e\u0439 Face ID. \u041a\u0430\u043a \u0432 \u0410\u043b\u044c\u0444\u0435 \u0438\u043b\u0438 \u0422\u0438\u043d\u044c\u043a\u043e\u0444\u0444.<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/29\/6b\/cf\/296bcfc2a058a4e4fe3f95af673d7dac.png\" width=\"1600\" height=\"1638\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/29\/6b\/cf\/296bcfc2a058a4e4fe3f95af673d7dac.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/29\/6b\/cf\/296bcfc2a058a4e4fe3f95af673d7dac.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/figure>\n<pre><code class=\"typescript\">function QuickLoginView({  passkeyUser,  onUsePassword,}: {  passkeyUser: PasskeyUser;  onUsePassword: () =&gt; void;}) {  const router = useRouter();  const { loginWithPasskey } = useAuth();  const [isLoading, setIsLoading] = useState(false);  const handleLogin = useCallback(async () =&gt; {    setIsLoading(true);    try {      await loginWithPasskey();      router.push(\"\/dashboard\");    } catch (error) {      if (error instanceof ApiError) {        \/\/ \u041a\u043b\u044e\u0447 \u0443\u0434\u0430\u043b\u0451\u043d \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u2014 \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c quick-login        if (error.message?.includes(\"Credential not found\")) {          clearPasskeyUser();          onUsePassword();          return;        }        toast.error(error.message);      } else if (error instanceof Error) {        \/\/ \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0437\u0430\u043a\u0440\u044b\u043b Face ID \u2014 \u043c\u043e\u043b\u0447\u0430 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u043c        if (!isWebAuthnCancellation(error)) {          toast.error(error.message);        }      }    } finally {      setIsLoading(false);    }  }, [loginWithPasskey, router, onUsePassword]);  \/\/ \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c Face ID \u0447\u0435\u0440\u0435\u0437 400ms \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438  useEffect(() =&gt; {    const timer = setTimeout(() =&gt; handleLogin(), 400);    return () =&gt; clearTimeout(timer);  }, []);  return (    &lt;div className=\"flex flex-col items-center py-4\"&gt;      &lt;div className=\"mb-5 flex h-14 w-14 items-center justify-center                      rounded-full bg-primary\/10\"&gt;        &lt;PiFingerprint className=\"h-7 w-7 text-primary\" \/&gt;      &lt;\/div&gt;      &lt;h2 className=\"text-xl font-medium\"&gt;        \u041f\u0440\u0438\u0432\u0435\u0442, {passkeyUser.name}      &lt;\/h2&gt;      &lt;p className=\"mt-1 text-sm text-gray-500\"&gt;        \u0412\u0445\u043e\u0434 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u043e Face ID      &lt;\/p&gt;      &lt;div className=\"mt-6 w-full space-y-3\"&gt;        &lt;Button className=\"w-full\" isLoading={isLoading} onClick={handleLogin}&gt;          &lt;PiFingerprint className=\"mr-2 h-5 w-5\" \/&gt;          \u0412\u043e\u0439\u0442\u0438 \u043f\u043e Face ID        &lt;\/Button&gt;        &lt;button          onClick={onUsePassword}          className=\"w-full text-center text-sm text-gray-500                     hover:text-gray-700 transition-colors\"        &gt;          \u0412\u043e\u0439\u0442\u0438 \u043f\u043e \u043f\u0430\u0440\u043e\u043b\u044e        &lt;\/button&gt;      &lt;\/div&gt;    &lt;\/div&gt;  );}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>\u041b\u043e\u0433\u0438\u043a\u0430 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0430 LoginForm<\/h4>\n<pre><code class=\"typescript\">function LoginForm() {  const [supportsWebAuthn, setSupportsWebAuthn] = useState(false);  const [passkeyUser, setPasskeyUser] = useState&lt;PasskeyUser | null&gt;(null);  const [forcePasswordMode, setForcePasswordMode] = useState(false);  useEffect(() =&gt; {    const supported = browserSupportsWebAuthn();    setSupportsWebAuthn(supported);    if (supported) {      setPasskeyUser(getPasskeyUser());    }  }, []);  \/\/ \u0415\u0441\u043b\u0438 \u0435\u0441\u0442\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u2014 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c Quick Login  if (passkeyUser &amp;&amp; supportsWebAuthn &amp;&amp; !forcePasswordMode) {    return (      &lt;QuickLoginView        passkeyUser={passkeyUser}        onUsePassword={() =&gt; setForcePasswordMode(true)}      \/&gt;    );  }  \/\/ \u0418\u043d\u0430\u0447\u0435 \u2014 \u043e\u0431\u044b\u0447\u043d\u0430\u044f \u0444\u043e\u0440\u043c\u0430 \u0441 \u043a\u043d\u043e\u043f\u043a\u043e\u0439 \"\u0412\u043e\u0439\u0442\u0438 \u043f\u043e Passkey\"  return (    &lt;form&gt;      {\/* email + password fields *\/}      &lt;Button type=\"submit\"&gt;\u0412\u043e\u0439\u0442\u0438&lt;\/Button&gt;      {supportsWebAuthn &amp;&amp; (        &lt;&gt;          &lt;Divider&gt;\u0438\u043b\u0438&lt;\/Divider&gt;          &lt;Button variant=\"secondary\" onClick={handlePasskeyLogin}&gt;            &lt;PiFingerprint className=\"mr-2 h-5 w-5\" \/&gt;            \u0412\u043e\u0439\u0442\u0438 \u043f\u043e Passkey          &lt;\/Button&gt;        &lt;\/&gt;      )}    &lt;\/form&gt;  );}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h4>Post-Login Passkey Prompt<\/h4>\n<p>\u041f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e \u043f\u0430\u0440\u043e\u043b\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c: \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f passkeys? \u0415\u0441\u043b\u0438 \u043d\u0435\u0442 \u0438 \u043e\u043d \u0435\u0449\u0451 \u043d\u0435 \u043e\u0442\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0441\u044f \u2014 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c.<\/p>\n<pre><code class=\"typescript\">const checkPasskeyPrompt = useCallback(async () =&gt; {  if (!supportsWebAuthn) return;  const resp = await fetch(\"\/api\/auth\/passkeys\/count\", {    headers: { Authorization: `Bearer ${token}` },  });  if (resp.ok) {    const { count } = await resp.json();    \/\/ \u0423 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0443\u0436\u0435 \u0435\u0441\u0442\u044c passkeys \u2014 \u043d\u0435 \u0442\u0440\u043e\u0433\u0430\u0435\u043c    if (count &gt; 0) return;    \/\/ \u0420\u0430\u043d\u0435\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u2014 \u043d\u0435 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c    if (localStorage.getItem(\"passkey_prompt_dismissed\")) return;    \/\/ \u041f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u043c\u043e\u0434\u0430\u043b\u043a\u0443    setShowPasskeyPrompt(true);  }}, [supportsWebAuthn]);<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u041c\u043e\u0434\u0430\u043b\u043a\u0430 \u043f\u0440\u043e\u0441\u0442\u0430\u044f: \u00ab\u0425\u043e\u0442\u0438\u0442\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0432\u0445\u043e\u0434 \u043f\u043e Face ID?\u00bb + \u0434\u0432\u0435 \u043a\u043d\u043e\u043f\u043a\u0438 \u2014 \u00ab\u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c\u00bb \u0438 \u00ab\u041d\u0435 \u0441\u0435\u0439\u0447\u0430\u0441\u00bb. \u041f\u0440\u0438 \u043e\u0442\u043a\u0430\u0437\u0435 \u0441\u0442\u0430\u0432\u0438\u043c \u0444\u043b\u0430\u0433 \u0432 localStorage.<\/p>\n<h4>PasskeysManager \u2014 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445<\/h4>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/extt\/e7\/b8\/7c\/e7b87c35abb41a99e6aceabc6d3b50b5.png\" width=\"2400\" height=\"1334\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/extt\/e7\/b8\/7c\/e7b87c35abb41a99e6aceabc6d3b50b5.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/extt\/e7\/b8\/7c\/e7b87c35abb41a99e6aceabc6d3b50b5.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/figure>\n<pre><code class=\"typescript\">export function PasskeysManager() {  const { user } = useAuth();  const { passkeys, isLoading, mutate } = usePasskeys();  const [isRegistering, setIsRegistering] = useState(false);  if (!browserSupportsWebAuthn()) {    return &lt;p&gt;\u0412\u0430\u0448 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 Passkeys&lt;\/p&gt;;  }  const handleAdd = async () =&gt; {    setIsRegistering(true);    try {      await registerPasskey();      toast.success(\"Passkey \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\");      if (user) {        savePasskeyUser(          user.first_name || user.email.split(\"@\")[0],          user.email,        );      }      mutate();    } catch (err) {      if (err instanceof Error &amp;&amp; !isWebAuthnCancellation(err)) {        toast.error(err.message);      }    } finally {      setIsRegistering(false);    }  };  const handleRename = async (id: string, name: string) =&gt; {    await renamePasskey(id, name);    toast.success(\"\u041f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043e\");    mutate();  };  const handleDelete = async (id: string) =&gt; {    await deletePasskey(id);    toast.success(\"Passkey \u0443\u0434\u0430\u043b\u0451\u043d\");    \/\/ \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u043a\u043b\u044e\u0447 \u0443\u0434\u0430\u043b\u0451\u043d \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u043c quick-login    if (passkeys.length &lt;= 1) clearPasskeyUser();    mutate();  };  return (    &lt;div className=\"space-y-3\"&gt;      {isLoading ? (        &lt;p&gt;\u0417\u0430\u0433\u0440\u0443\u0437\u043a\u0430...&lt;\/p&gt;      ) : passkeys.length === 0 ? (        &lt;p className=\"text-gray-500\"&gt;\u041d\u0435\u0442 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432&lt;\/p&gt;      ) : (        passkeys.map((pk) =&gt; (          &lt;PasskeyItem            key={pk.id}            passkey={pk}            onRename={handleRename}            onDelete={handleDelete}          \/&gt;        ))      )}      &lt;Button        onClick={handleAdd}        isLoading={isRegistering}        variant=\"secondary\"      &gt;        \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e      &lt;\/Button&gt;    &lt;\/div&gt;  );}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<h3>\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c<\/h3>\n<p>\u041d\u0435 \u0434\u043b\u044f \u0433\u0430\u043b\u043e\u0447\u043a\u0438 \u2014 \u0442\u0443\u0442 \u0435\u0441\u0442\u044c \u043d\u044e\u0430\u043d\u0441\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0430\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c.<\/p>\n<h4>Challenge: \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439, 5 \u043c\u0438\u043d\u0443\u0442<\/h4>\n<p>\u0421\u0435\u0440\u0432\u0435\u0440 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0435 32 \u0431\u0430\u0439\u0442\u0430 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438. Challenge \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0411\u0414, \u0430 \u043f\u0440\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u2014 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442\u0441\u044f \u0438 <strong>\u0441\u0440\u0430\u0437\u0443 \u0443\u0434\u0430\u043b\u044f\u0435\u0442\u0441\u044f<\/strong> (<code>_pop_challenge<\/code>). \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0430\u0436\u0434\u044b \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.<\/p>\n<p>TTL \u2014 5 \u043c\u0438\u043d\u0443\u0442. \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0442\u0432\u043b\u0451\u043a\u0441\u044f \u0438 \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b Face ID \u0437\u0430 5 \u043c\u0438\u043d\u0443\u0442 \u2014 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c. \u041f\u043e\u0434\u0431\u0438\u0440\u0430\u0442\u044c challenge \u0431\u0435\u0441\u0441\u043c\u044b\u0441\u043b\u0435\u043d\u043d\u043e: 32 \u0431\u0430\u0439\u0442\u0430 = 2^256 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432.<\/p>\n<h4>Sign Count: \u0434\u0435\u0442\u0435\u043a\u0446\u0438\u044f \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439<\/h4>\n<p>\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u0440\u0438 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 \u0441\u0447\u0451\u0442\u0447\u0438\u043a \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u0421\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442: \u043f\u0440\u0438\u0448\u0435\u0434\u0448\u0438\u0439 sign_count \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c <strong>\u0441\u0442\u0440\u043e\u0433\u043e \u0431\u043e\u043b\u044c\u0448\u0435<\/strong> \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u043e\u0433\u043e.<\/p>\n<p>\u0415\u0441\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043b\u044e\u0447 (\u0447\u0442\u043e \u043f\u043e\u0447\u0442\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0441 Secure Enclave, \u043d\u043e \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u043c\u0438 \u043a\u043b\u044e\u0447\u0430\u043c\u0438) \u2014 \u0438 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b, \u0438 \u043a\u043b\u043e\u043d \u0431\u0443\u0434\u0443\u0442 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u0447\u0451\u0442\u0447\u0438\u043a \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e. \u0420\u0430\u043d\u043e \u0438\u043b\u0438 \u043f\u043e\u0437\u0434\u043d\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0443\u0432\u0438\u0434\u0438\u0442, \u0447\u0442\u043e \u043f\u0440\u0438\u0448\u0451\u043b sign_count \u043c\u0435\u043d\u044c\u0448\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0433\u043e \u2014 \u0437\u043d\u0430\u0447\u0438\u0442, \u043a\u043b\u044e\u0447 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d.<\/p>\n<p>py-webauthn \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 <code>verify_authentication_response()<\/code>.<\/p>\n<h4>Origin Verification: \u043f\u043e\u0447\u0435\u043c\u0443 \u0444\u0438\u0448\u0438\u043d\u0433 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d<\/h4>\n<p>\u0412\u043e\u0442 \u043f\u043e\u0447\u0435\u043c\u0443 Passkeys \u0444\u0443\u043d\u0434\u0430\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u043f\u0430\u0440\u043e\u043b\u0435\u0439:<\/p>\n<p>\u041a\u043e\u0433\u0434\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 <code>navigator.credentials.get()<\/code>, \u043e\u043d \u043f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0432 \u043e\u0442\u0432\u0435\u0442\u0435 <strong>origin<\/strong> \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b. \u042d\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0431\u0440\u0430\u0443\u0437\u0435\u0440, \u043d\u0435 JavaScript \u2014 \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.<\/p>\n<p>\u0421\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442: origin \u0438\u0437 \u043e\u0442\u0432\u0435\u0442\u0430 === <code>WEBAUTHN_RP_ORIGIN<\/code> \u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0433\u0430.<\/p>\n<p>\u0415\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043e\u0437\u0434\u0430\u043b \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0439 \u0441\u0430\u0439\u0442 <a href=\"https:\/\/evil.com\" rel=\"noopener nofollow\"><code>https:\/\/evil.com<\/code><\/a> \u2014 origin \u0431\u0443\u0434\u0435\u0442 <a href=\"https:\/\/evil.com\" rel=\"noopener nofollow\"><code>https:\/\/evil.com<\/code><\/a>, \u0430 \u043d\u0435 <a href=\"https:\/\/example.com\" rel=\"noopener nofollow\"><code>https:\/\/example.com<\/code><\/a>. \u0412\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0443\u043f\u0430\u0434\u0451\u0442. \u041f\u0430\u0440\u043e\u043b\u044c \u043c\u043e\u0436\u043d\u043e \u0432\u0432\u0435\u0441\u0442\u0438 \u043d\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0441\u0430\u0439\u0442\u0435. Passkey \u2014 \u043d\u0435\u0442.<\/p>\n<h4>Resident Keys: \u0432\u0445\u043e\u0434 \u0431\u0435\u0437 email<\/h4>\n<p><code>ResidentKeyRequirement.PREFERRED<\/code> \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443: \u00ab\u0441\u043e\u0445\u0440\u0430\u043d\u0438 credential_id \u0438 user_id \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0431\u044f\u00bb. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u0433\u0438\u043d\u0438\u0442\u044c\u0441\u044f <strong>\u0431\u0435\u0437 \u0432\u0432\u043e\u0434\u0430 email<\/strong> \u2014 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0441\u0430\u043c\u043e \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438 \u0435\u0441\u0442\u044c \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430, \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u0442 \u0432\u044b\u0431\u0440\u0430\u0442\u044c.<\/p>\n<p>\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435: \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 \u0441\u0430\u0439\u0442 \u2192 \u043d\u0430\u0436\u0438\u043c\u0430\u0435\u0442 \u00ab\u0412\u043e\u0439\u0442\u0438 \u043f\u043e Face ID\u00bb \u2192 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u2192 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u2192 Face ID \u2192 \u0433\u043e\u0442\u043e\u0432\u043e. Email \u043d\u0435 \u043d\u0443\u0436\u0435\u043d.<\/p>\n<h3>\u0413\u0440\u0430\u0431\u043b\u0438<\/h3>\n<p>\u0411\u0435\u0437 \u044d\u0442\u043e\u0433\u043e \u0440\u0430\u0437\u0434\u0435\u043b\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u0431\u044b\u043b\u0430 \u0431\u044b \u043d\u0435\u0447\u0435\u0441\u0442\u043d\u043e\u0439. \u0412\u043e\u0442 \u043d\u0430 \u0447\u0451\u043c \u043c\u044b \u0441\u043f\u043e\u0442\u043a\u043d\u0443\u043b\u0438\u0441\u044c.<\/p>\n<h4>RP ID vs Origin \u2014 \u0432 \u0447\u0451\u043c \u0440\u0430\u0437\u043d\u0438\u0446\u0430<\/h4>\n<p><code>RP_ID<\/code> \u2014 \u044d\u0442\u043e \u0434\u043e\u043c\u0435\u043d. <code>RP_ORIGIN<\/code> \u2014 \u044d\u0442\u043e \u043f\u043e\u043b\u043d\u044b\u0439 URL \u0441 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c. \u041c\u044b \u043f\u0435\u0440\u0435\u043f\u0443\u0442\u0430\u043b\u0438, \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 <code>RP_ID=<\/code><a href=\"https:\/\/example.com\" rel=\"noopener nofollow\"><code>https:\/\/example.com<\/code><\/a> \u0432\u043c\u0435\u0441\u0442\u043e <code>RP_ID=<\/code><a href=\"http:\/\/example.com\" rel=\"noopener nofollow\"><code>example.com<\/code><\/a>. \u041f\u043e\u043b\u0443\u0447\u0438\u043b\u0438:<\/p>\n<pre><code>SecurityError: The RP ID is not a registrable domain suffixof the current origin<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><span class=\"sc-logo-wrapper icon-only\"><\/span><\/a><\/div><\/pre>\n<p>\u041c\u043e\u0440\u0430\u043b\u044c: <code>RP_ID<\/code> = \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u043c\u0435\u043d, \u0431\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0440\u0442\u0430.<\/p>\n<h4>NotAllowedError \u2014 \u044d\u0442\u043e \u043d\u0435 \u043e\u0448\u0438\u0431\u043a\u0430<\/h4>\n<p>\u041a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0434\u0438\u0430\u043b\u043e\u0433 Face ID \u2014 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0431\u0440\u043e\u0441\u0430\u0435\u0442 <code>NotAllowedError<\/code>. \u0415\u0441\u043b\u0438 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c <code>toast.error()<\/code> \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0432\u0438\u0434\u0438\u0442 \u043a\u0440\u0430\u0441\u043d\u043e\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0434\u0443\u043c\u0430\u043b. \u041d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u043e.<\/p>\n<p>\u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u2014 \u0444\u0443\u043d\u043a\u0446\u0438\u044f <code>isWebAuthnCancellation()<\/code>, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0442\u0435\u043a\u0441\u0442 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u0430\u043c (\u043a\u0430\u0436\u0434\u044b\u0439 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u0444\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u0443\u0435\u0442 \u043f\u043e-\u0441\u0432\u043e\u0435\u043c\u0443). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u043e\u0442\u043c\u0435\u043d\u0430 \u2014 \u043c\u043e\u043b\u0447\u0430 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u043c.<\/p>\n<h4>Localhost \u2192 Production<\/h4>\n<p>WebAuthn API <strong>\u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 HTTP<\/strong> \u2014 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 HTTPS. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435: <a href=\"http:\/\/localhost\" rel=\"noopener nofollow\"><code>localhost<\/code><\/a>. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u043a\u0435 \u0432\u0441\u0451 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u0430 \u043f\u0440\u0438 \u0434\u0435\u043f\u043b\u043e\u0435 \u2014 \u043d\u0435\u0442.<\/p>\n<p>\u0427\u0435\u043a\u043b\u0438\u0441\u0442 \u0434\u043b\u044f production:<\/p>\n<ul>\n<li>\n<p><code>WEBAUTHN_RP_ID=<\/code><a href=\"http:\/\/yourdomain.com\" rel=\"noopener nofollow\"><code>yourdomain.com<\/code><\/a> (\u043d\u0435 <a href=\"http:\/\/localhost\" rel=\"noopener nofollow\">localhost<\/a>)<\/p>\n<\/li>\n<li>\n<p><code>WEBAUTHN_RP_ORIGIN=<\/code><a href=\"https:\/\/yourdomain.com\" rel=\"noopener nofollow\"><code>https:\/\/yourdomain.com<\/code><\/a> (https!)<\/p>\n<\/li>\n<li>\n<p>\u0412\u0430\u043b\u0438\u0434\u043d\u044b\u0439 SSL-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442<\/p>\n<\/li>\n<\/ul>\n<h4>\u0421\u0443\u0431\u0434\u043e\u043c\u0435\u043d\u044b<\/h4>\n<p>\u0415\u0441\u043b\u0438 \u0444\u0440\u043e\u043d\u0442 \u043d\u0430 <a href=\"http:\/\/app.example.com\" rel=\"noopener nofollow\"><code>app.example.com<\/code><\/a>, \u0430 API \u043d\u0430 <a href=\"http:\/\/api.example.com\" rel=\"noopener nofollow\"><code>api.example.com<\/code><\/a>:<\/p>\n<ul>\n<li>\n<p><code>RP_ID = <\/code><a href=\"http:\/\/example.com\" rel=\"noopener nofollow\"><code>example.com<\/code><\/a> \u2014 \u043e\u0431\u0449\u0438\u0439 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0434\u043e\u043c\u0435\u043d<\/p>\n<\/li>\n<li>\n<p><code>RP_ORIGIN = <\/code><a href=\"https:\/\/app.example.com\" rel=\"noopener nofollow\"><code>https:\/\/app.example.com<\/code><\/a> \u2014 \u043e\u0442\u043a\u0443\u0434\u0430 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f WebAuthn<\/p>\n<\/li>\n<\/ul>\n<p>\u0415\u0441\u043b\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c <code>RP_ID = <\/code><a href=\"http:\/\/app.example.com\" rel=\"noopener nofollow\"><code>app.example.com<\/code><\/a> \u2014 \u0442\u043e\u0436\u0435 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043d\u043e passkey \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 <a href=\"http:\/\/admin.example.com\" rel=\"noopener nofollow\"><code>admin.example.com<\/code><\/a> (\u0435\u0441\u043b\u0438 \u0432\u0434\u0440\u0443\u0433 \u0437\u0430\u0445\u043e\u0442\u0438\u0442\u0435 \u043e\u0431\u0449\u0443\u044e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e).<\/p>\n<h4>\u041f\u043e\u043b\u043d\u0430\u044f \u0442\u0430\u0431\u043b\u0438\u0446\u0430 \u043e\u0448\u0438\u0431\u043e\u043a<\/h4>\n<div>\n<div class=\"table\">\n<table>\n<tbody>\n<tr>\n<th>\n<p align=\"left\">\u041e\u0448\u0438\u0431\u043a\u0430<\/p>\n<\/th>\n<th>\n<p align=\"left\">\u041f\u0440\u0438\u0447\u0438\u043d\u0430<\/p>\n<\/th>\n<th>\n<p align=\"left\">\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c<\/p>\n<\/th>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>SecurityError: RP ID is not a registrable domain suffix<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\"><code>RP_ID<\/code> \u043d\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442 \u0441 \u0434\u043e\u043c\u0435\u043d\u043e\u043c \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434\u0430<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c env, \u0443\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0438\u0437 RP_ID<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>NotAllowedError: The operation was cancelled<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0437\u0430\u043a\u0440\u044b\u043b \u0434\u0438\u0430\u043b\u043e\u0433 Face ID<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041d\u0435 \u043e\u0448\u0438\u0431\u043a\u0430 \u2014 <code>isWebAuthnCancellation()<\/code><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>Challenge not found or expired<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">Challenge \u043f\u0440\u043e\u0442\u0443\u0445 (&gt;5 \u043c\u0438\u043d) \u0438\u043b\u0438 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 <code>\/options<\/code><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>Registration verification failed<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">Origin \u043d\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c <code>WEBAUTHN_RP_ORIGIN<\/code><\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>Credential not found<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041a\u043b\u044e\u0447 \u0443\u0434\u0430\u043b\u0451\u043d \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043d \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u041f\u0435\u0440\u0435\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c passkey<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p align=\"left\"><code>Authentication verification failed<\/code><\/p>\n<\/td>\n<td>\n<p align=\"left\">sign_count \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442 (\u043a\u043b\u043e\u043d?)<\/p>\n<\/td>\n<td>\n<p align=\"left\">\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u043a\u043b\u044e\u0447, \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0437\u0430\u043d\u043e\u0432\u043e<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u044f \u043f\u0438\u0441\u0430\u043b, \u0447\u0442\u043e \u0432\u0430\u0448 \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0441\u0438\u0442 <code>Qwerty123!<\/code>. \u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u0434\u043d\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u0448 \u2014 \u0443\u0436\u0435 \u043d\u0435\u0442.<\/p>\n<p>\u0427\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u043e\u0441\u044c \u043f\u043e \u0444\u0430\u043a\u0442\u0443:<\/p>\n<ul>\n<li>\n<p><strong>2 \u0442\u0430\u0431\u043b\u0438\u0446\u044b<\/strong> \u0432 PostgreSQL, <strong>4 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430<\/strong>, <strong>1 \u0444\u0440\u043e\u043d\u0442-\u0443\u0442\u0438\u043b\u0438\u0442\u0430<\/strong> \u2014 \u044d\u0442\u043e \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e Passkey-\u043b\u043e\u0433\u0438\u043d\u0430<\/p>\n<\/li>\n<li>\n<p><strong>~3 \u0434\u043d\u044f<\/strong> \u043e\u0442 \u00ab\u0434\u0430\u0432\u0430\u0439\u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0431\u0443\u0435\u043c\u00bb \u0434\u043e production. \u0411\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u2014 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438. \u0421\u0430\u043c \u043a\u043e\u0434 \u043f\u0440\u043e\u0441\u0442\u043e\u0439, \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0437\u0430 \u0442\u0435\u0431\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e \u0438 \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u043c\u0438<\/p>\n<\/li>\n<li>\n<p><strong>\u041d\u043e\u043b\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0431\u0440\u043e\u0441 \u043f\u0430\u0440\u043e\u043b\u044f<\/strong> \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b\u0438 passkey. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0430\u0440\u043e\u043b\u044f \u043d\u0435\u0442 \u2014 \u043d\u0435\u0447\u0435\u0433\u043e \u0437\u0430\u0431\u044b\u0432\u0430\u0442\u044c<\/p>\n<\/li>\n<li>\n<p><strong>\u0424\u0438\u0448\u0438\u043d\u0433 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d<\/strong> \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430. \u041d\u0435 \u00ab\u043d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0451\u0442\u0441\u044f\u00bb, \u0430 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 origin \u0437\u0430\u0448\u0438\u0442 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e<\/p>\n<\/li>\n<\/ul>\n<p>\u042d\u0442\u043e \u043c\u043e\u044f \u043f\u0435\u0440\u0432\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043d\u0430 \u0425\u0430\u0431\u0440\u0435. \u041f\u0438\u0441\u0430\u043b \u0442\u043e, \u0447\u0442\u043e \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0430\u043c, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u0447\u0438\u043d\u0430\u043b \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u0442\u0435\u043c\u0435 \u2014 \u043f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043a\u043e\u0434, \u0431\u0435\u0437 \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u043e\u0434\u044b.<\/p>\n<p>\u0423 \u043c\u0435\u043d\u044f \u043e\u0441\u0442\u0430\u043b\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441: \u043c\u044b \u0445\u0440\u0430\u043d\u0438\u043c challenge \u0432 PostgreSQL, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u0438 \u0442\u0430\u0449\u0438\u0442\u044c Redis \u0440\u0430\u0434\u0438 32-\u0431\u0430\u0439\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0441 TTL 5 \u043c\u0438\u043d\u0443\u0442. \u041f\u0440\u0438 \u043d\u0430\u0448\u0435\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442. \u041d\u043e \u0435\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u0442\u044b\u0441\u044f\u0447\u0438 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043b\u043e\u0433\u0438\u043d\u043e\u0432 \u2014 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u043f\u0440\u043e\u0431\u043e\u0432\u0430\u043b Redis \u0438\u043b\u0438 in-memory store \u0434\u043b\u044f challenge? \u0415\u0441\u0442\u044c \u043b\u0438 \u043e\u0449\u0443\u0442\u0438\u043c\u0430\u044f \u0440\u0430\u0437\u043d\u0438\u0446\u0430?<\/p>\n<p>\u0418 \u0448\u0438\u0440\u0435 \u2014 \u0435\u0441\u043b\u0438 \u0432\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u043b\u0438 Passkeys \u0432 \u0441\u0432\u043e\u0451\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0435, \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0438\u0442\u0435, \u043a\u0430\u043a \u0440\u0435\u0448\u0430\u043b\u0438. \u041c\u043e\u0436\u0435\u0442, \u0435\u0441\u0442\u044c \u043f\u043e\u0434\u0445\u043e\u0434 \u043f\u0440\u043e\u0449\u0435 \u0438\u043b\u0438 \u0433\u0440\u0430\u0431\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u043b. \u0411\u0443\u0434\u0443 \u0440\u0430\u0434 \u043e\u0431\u0441\u0443\u0434\u0438\u0442\u044c \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445.<\/p>\n<\/div>\n<p>\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/1092816\/\">https:\/\/habr.com\/ru\/articles\/1092816\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Passkeys \u2014 \u044d\u0442\u043e \u043d\u0435 \u0431\u0443\u0434\u0443\u0449\u0435\u0435. \u042d\u0442\u043e \u0443\u0436\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0435. \u0410\u043b\u044c\u0444\u0430-\u0411\u0430\u043d\u043a, \u0422\u0438\u043d\u044c\u043a\u043e\u0444\u0444, \u0421\u0431\u0435\u0440 \u2014 \u0434\u0430\u0432\u043d\u043e. GitHub, Apple, Google \u2014 \u0442\u043e\u0436\u0435. \u0410 \u0432\u0430\u0448 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0441\u0438\u0442 \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u0441 \u0437\u0430\u0433\u043b\u0430\u0432\u043d\u043e\u0439 \u0431\u0443\u043a\u0432\u043e\u0439, \u0446\u0438\u0444\u0440\u043e\u0439 \u0438 \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u043c. \u0418 \u043f\u043e\u0442\u043e\u043c \u0435\u0449\u0451 \u00ab\u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c\u00bb \u0440\u0430\u0437 \u0432 \u043c\u0435\u0441\u044f\u0446.\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u042f\u0440\u043e\u0441\u043b\u0430\u0432 \u041c\u043e\u0440\u043e\u0437\u043e\u0432, \u044f \u0441\u0442\u0440\u043e\u044e Continental \u2014 IT-\u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433 \u0438 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u0438\u0448\u0443 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442. \u041a\u043e\u0433\u0434\u0430 \u0434\u043e\u0448\u043b\u0438 \u0434\u043e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0440\u0435\u0448\u0438\u043b\u0438 \u043d\u0435 \u043c\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 Passkeys. \u041e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u0449\u0435, \u0447\u0435\u043c \u044f \u0434\u0443\u043c\u0430\u043b.\u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u2014 \u043f\u043e\u043b\u043d\u044b\u0439 production-\u043a\u043e\u0434. \u041e\u0442 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0434\u043e \u043a\u043d\u043e\u043f\u043a\u0438 \u00ab\u0412\u043e\u0439\u0442\u0438 \u043f\u043e Face ID\u00bb. FastAPI \u043d\u0430 \u0431\u044d\u043a\u0435, Next.js \u043d\u0430 \u0444\u0440\u043e\u043d\u0442\u0435. \u041c\u043e\u0436\u043d\u043e \u0432\u0437\u044f\u0442\u044c \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c.\u0417\u0430\u0447\u0435\u043c \u0432\u043e\u043e\u0431\u0449\u0435 Passkeys\u041a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u043e\u0442\u0432\u0435\u0442 \u2014 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u0438 \u0443\u0434\u043e\u0431\u043d\u0435\u0435. \u0414\u043b\u0438\u043d\u043d\u044b\u0439:\u041f\u0430\u0440\u043e\u043b\u0438Passkeys\u0424\u0438\u0448\u0438\u043d\u0433\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u0430\u0440\u043e\u043b\u044c \u043d\u0430 \u0444\u0435\u0439\u043a\u043e\u0432\u043e\u043c \u0441\u0430\u0439\u0442\u0435\u041d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d \u2014 \u043a\u043b\u044e\u0447 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a \u0434\u043e\u043c\u0435\u043d\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438\u0423\u0442\u0435\u0447\u043a\u0438 \u0411\u0414\u0425\u0435\u0448\u0438 bcrypt \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0442\u044c \u043c\u0435\u0441\u044f\u0446\u0430\u043c\u0438. \u0418\u043b\u0438 \u043d\u0435 \u043c\u043e\u0436\u043d\u043e, \u043d\u043e \u043f\u043e\u043f\u0440\u043e\u0431\u0443\u044e\u0442\u041f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u043d\u0435 \u043f\u043e\u043a\u0438\u0434\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0412 \u0411\u0414 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439UX\u041f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c, \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u0432\u0432\u0435\u0441\u0442\u0438. \u0417\u0430\u0431\u044b\u043b \u2014 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0439\u041f\u0430\u043b\u0435\u0446 \u043d\u0430 \u0441\u043a\u0430\u043d\u0435\u0440 \u0438\u043b\u0438 \u0432\u0437\u0433\u043b\u044f\u0434 \u0432 \u043a\u0430\u043c\u0435\u0440\u0443. \u0412\u0441\u0451\u041f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u043565% \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0434\u0438\u043d \u043f\u0430\u0440\u043e\u043b\u044c \u0432\u0435\u0437\u0434\u0435\u0423\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0430\u0440\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438Passkeys \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435\u043c\u0438 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438:\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c FIDO Alliance, \u0431\u043e\u043b\u0435\u0435 15 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u0443\u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 passkeys. Google, Apple, Microsoft \u2014 \u0432\u0441\u0435 \u0442\u0440\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u2014 \u0432\u0441\u0442\u0440\u043e\u0438\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u041e\u0421.\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 Passkeys \u2014 \u044d\u0442\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u0430 WebAuthn (W3C) \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 FIDO2. \u041d\u043e \u0432\u0430\u043c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e \u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 200 \u0441\u0442\u0440\u0430\u043d\u0438\u0446. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442 \u0437\u0430 \u0432\u0430\u0441 90% \u0440\u0430\u0431\u043e\u0442\u044b.\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442\u041d\u0430 \u043f\u0430\u043b\u044c\u0446\u0430\u0445Passkey \u2014 \u044d\u0442\u043e \u043f\u0430\u0440\u0430 \u0430\u0441\u0438\u043c\u043c\u0435\u0442\u0440\u0438\u0447\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439:\u041f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0436\u0438\u0432\u0451\u0442 \u0432 Secure Enclave \u0432\u0430\u0448\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u042d\u0442\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u0447\u0438\u043f, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0434\u0430\u0436\u0435 \u041e\u0421 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u044f\u043c\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041a\u043b\u044e\u0447 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u043f\u043e\u043a\u0438\u0434\u0430\u0435\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e.\u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0411\u0414.\u041f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 challenge (32 \u0431\u0430\u0439\u0442\u0430). \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0433\u043e \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c (\u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0431\u0438\u043e\u043c\u0435\u0442\u0440\u0438\u0435\u0439). \u0421\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c.\u0412\u0441\u0451. \u041f\u0430\u0440\u043e\u043b\u044c \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0435\u0433\u043e \u043d\u0435\u0442.\u0421\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438\u0421\u043e\u0437\u0434\u0430\u043b\u0438 passkey \u043d\u0430 iPhone \u2014 \u043e\u043d \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u044f\u0432\u0438\u0442\u0441\u044f \u043d\u0430 MacBook \u0447\u0435\u0440\u0435\u0437 iCloud Keychain. \u0421\u043e\u0437\u0434\u0430\u043b\u0438 \u043d\u0430 Android \u2014 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 Google Password Manager. \u042d\u0442\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f Discoverable Credentials \u2014 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0441\u0430\u043c\u043e \u0437\u043d\u0430\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438 \u0435\u0441\u0442\u044c \u0434\u043b\u044f \u043a\u0430\u043a\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430.\u0421\u0432\u044f\u0437\u044c \u0441 JWT\u0412\u0430\u0436\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442: Passkeys \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u044e\u0442 JWT. \u041e\u043d\u0438 \u0437\u0430\u043c\u0435\u043d\u044f\u044e\u0442 \u0432\u0432\u043e\u0434 \u043b\u043e\u0433\u0438\u043d\u0430-\u043f\u0430\u0440\u043e\u043b\u044f. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 passkey \u0431\u044d\u043a\u0435\u043d\u0434 \u0432\u044b\u0434\u0430\u0451\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 JWT-\u0442\u043e\u043a\u0435\u043d\u044b (access + refresh), \u0438 \u0434\u0430\u043b\u044c\u0448\u0435 \u0432\u0441\u0451 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0440\u0430\u043d\u044c\u0448\u0435. \u041d\u0435 \u043d\u0430\u0434\u043e \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u0432\u0441\u044e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044e.\u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f Passkey\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\u041e\u0431\u0449\u0430\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 (\u0447\u0442\u043e \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0433\u0434\u0435)\u0421\u0442\u0435\u043a \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438\u041c\u0438\u043d\u0438\u043c\u0443\u043c \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0414\u0432\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u043f\u043e\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0432\u0441\u0451:Backend (Python):pip install webauthn&gt;=2.0.0py-webauthn \u2014 \u0437\u0440\u0435\u043b\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0430\u0432\u0442\u043e\u0440 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 WebAuthn. \u0413\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u0442 challenge, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043e\u0442\u0432\u0435\u0442\u044b, \u043f\u0430\u0440\u0441\u0438\u0442 CBOR. \u0411\u0435\u0437 \u043d\u0435\u0451 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0431\u044b \u0440\u0443\u043a\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u043c\u0438 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u043c\u0438 \u2014 \u043f\u043e\u0432\u0435\u0440\u044c\u0442\u0435, \u043d\u0435 \u0445\u043e\u0442\u0438\u0442\u0435.Frontend (TypeScript):npm install @simplewebauthn\/browser @simplewebauthn\/typesSimpleWebAuthn \u2014 \u043e\u0431\u0451\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 navigator.credentials. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0446\u0435\u043d\u043d\u043e\u0441\u0442\u044c: \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0443\u0435\u0442 ArrayBuffer \u2194 base64url \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438. \u041a\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0441 WebCrypto API, \u0437\u043d\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u0431\u043e\u043b\u044c \u2014 \u0431\u0435\u0441\u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 btoa(), Uint8Array, TextEncoder. SimpleWebAuthn \u0443\u0431\u0438\u0440\u0430\u0435\u0442 \u0432\u0441\u0451 \u044d\u0442\u043e.\u0411\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445\u0414\u0432\u0435 \u0442\u0430\u0431\u043b\u0438\u0446\u044b. \u0412\u0441\u0451.webauthn_credentials \u2014 \u0445\u0440\u0430\u043d\u0438\u0442 \u043a\u043b\u044e\u0447\u0438CREATE TABLE webauthn_credentials (    id              UUID        PRIMARY KEY DEFAULT gen_random_uuid(),    user_id         UUID        NOT NULL REFERENCES users(id) ON DELETE CASCADE,    credential_id   BYTEA       NOT NULL UNIQUE,    public_key      BYTEA       NOT NULL,    sign_count      INTEGER     DEFAULT 0,    transports      VARCHAR(255),    device_name     VARCHAR(100),    created_at      TIMESTAMPTZ DEFAULT now(),    last_used_at    TIMESTAMPTZ);CREATE INDEX ix_webauthn_cred_credential_id ON webauthn_credentials(credential_id);CREATE INDEX ix_webauthn_cred_user_id ON webauthn_credentials(user_id);\u0427\u0442\u043e \u0442\u0443\u0442 \u0447\u0442\u043e:credential_id (BYTEA) \u2014 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0439 ID \u043a\u043b\u044e\u0447\u0430, \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c. \u041f\u043e \u043d\u0435\u043c\u0443 \u0438\u0449\u0435\u043c credential \u043f\u0440\u0438 \u043b\u043e\u0433\u0438\u043d\u0435. \u0412 API \u0445\u043e\u0434\u0438\u0442 \u043a\u0430\u043a base64url-\u0441\u0442\u0440\u043e\u043a\u0430, \u0432 \u0411\u0414 \u043b\u0435\u0436\u0438\u0442 \u043a\u0430\u043a raw bytes.public_key (BYTEA) \u2014 COSE-\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 \u043a\u043b\u044e\u0447. \u0418\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.sign_count \u2014 \u0441\u0447\u0451\u0442\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0438\u043d\u043a\u0440\u0435\u043c\u0435\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0438 \u043a\u0430\u0436\u0434\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438. \u0415\u0441\u043b\u0438 \u043f\u0440\u0438\u0448\u0451\u043b sign_count \u043c\u0435\u043d\u044c\u0448\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u043e\u0433\u043e \u2014 \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043b\u044e\u0447. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 \u00ab\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u00bb.transports \u2014 JSON-\u043c\u0430\u0441\u0441\u0438\u0432: [&#171;internal&#187;] \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 (Face ID, Touch ID), [&#171;usb&#187;] \u0434\u043b\u044f YubiKey, [&#171;hybrid&#187;] \u0434\u043b\u044f QR-code flow. \u041f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0443 \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0439 UI.device_name \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0437\u0432\u0430\u0442\u044c \u043a\u043b\u044e\u0447: \u00abiPhone \u0440\u0430\u0431\u043e\u0442\u0430\u00bb, \u00abMacBook \u0434\u043e\u043c\u00bb. \u0427\u0438\u0441\u0442\u043e \u0434\u043b\u044f UX.webauthn_challenges \u2014 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0435 challengeCREATE TABLE webauthn_challenges (    id          UUID        PRIMARY KEY DEFAULT gen_random_uuid(),    user_id     UUID        REFERENCES users(id) ON DELETE CASCADE,    challenge   BYTEA       NOT NULL,    created_at  TIMESTAMPTZ DEFAULT now());Challenge \u0436\u0438\u0432\u0451\u0442 5 \u043c\u0438\u043d\u0443\u0442. \u041f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u2014 \u0443\u0434\u0430\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0437 \u0411\u0414. \u041e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439, \u043a\u0430\u043a OTP.user_id nullable \u2014 \u043f\u0440\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0437\u043d\u0430\u0435\u043c, \u043a\u0442\u043e \u043b\u043e\u0433\u0438\u043d\u0438\u0442\u0441\u044f (discoverable credentials), \u043f\u043e\u044d\u0442\u043e\u043c\u0443 challenge \u0441\u043e\u0437\u0434\u0430\u0451\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.\u041f\u043e\u0447\u0435\u043c\u0443 PostgreSQL, \u0430 \u043d\u0435 Redis? \u0414\u043b\u044f challenge-\u0435\u0439 \u0445\u0432\u0430\u0442\u0430\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0439 \u0442\u0430\u0431\u043b\u0438\u0446\u044b. \u0418\u0445 \u043c\u0430\u043b\u043e (1 challenge \u043d\u0430 1 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043b\u043e\u0433\u0438\u043d\u0430), \u043e\u043d\u0438 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0435 (32 \u0431\u0430\u0439\u0442\u0430 + \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435), \u0436\u0438\u0432\u0443\u0442 \u043d\u0435\u0434\u043e\u043b\u0433\u043e. \u0415\u0441\u043b\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u044b\u0440\u0430\u0441\u0442\u0435\u0442 \u2014 \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0432 Redis \u0437\u0430 15 \u043c\u0438\u043d\u0443\u0442, API \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u0441\u044f.SQLAlchemy-\u043c\u043e\u0434\u0435\u043b\u0438import uuidfrom datetime import datetimefrom sqlalchemy import DateTime, ForeignKey, Integer, LargeBinary, String, funcfrom sqlalchemy.dialects.postgresql import UUIDfrom sqlalchemy.orm import Mapped, mapped_column, relationshipclass WebAuthnCredential(Base):    __tablename__ = &#171;webauthn_credentials&#187;    id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4,    )    user_id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True),        ForeignKey(&#171;users.id&#187;, ondelete=&#187;CASCADE&#187;),        nullable=False,    )    credential_id: Mapped[bytes] = mapped_column(        LargeBinary, unique=True, index=True, nullable=False,    )    public_key: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)    sign_count: Mapped[int] = mapped_column(Integer, default=0)    transports: Mapped[str | None] = mapped_column(String(255), nullable=True)    device_name: Mapped[str | None] = mapped_column(String(100), nullable=True)    created_at: Mapped[datetime] = mapped_column(        DateTime(timezone=True), server_default=func.now(),    )    last_used_at: Mapped[datetime | None] = mapped_column(        DateTime(timezone=True), nullable=True,    )    user: Mapped[&#171;User&#187;] = relationship(back_populates=&#187;webauthn_credentials&#187;)class WebAuthnChallenge(Base):    __tablename__ = &#171;webauthn_challenges&#187;    id: Mapped[uuid.UUID] = mapped_column(        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4,    )    user_id: Mapped[uuid.UUID | None] = mapped_column(        UUID(as_uuid=True),        ForeignKey(&#171;users.id&#187;, ondelete=&#187;CASCADE&#187;),        nullable=True,    )    challenge: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)    created_at: Mapped[datetime] = mapped_column(        DateTime(timezone=True), server_default=func.now(),    )\u0412 \u043c\u043e\u0434\u0435\u043b\u0438 User \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c relationship:class User(Base):    # &#8230; \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044f &#8230;    webauthn_credentials: Mapped[list[&#171;WebAuthnCredential&#187;]] = relationship(        back_populates=&#187;user&#187;,        cascade=&#187;all, delete-orphan&#187;,  # \u0423\u0434\u0430\u043b\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u2014 \u0443\u0434\u0430\u043b\u0438\u043b\u0438\u0441\u044c \u0435\u0433\u043e \u043a\u043b\u044e\u0447\u0438    )Backend: \u043f\u043e\u043b\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0422\u0440\u0438 env-\u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435:# \u0414\u043e\u043c\u0435\u043d \u0441\u0430\u0439\u0442\u0430 \u2014 \u0431\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430, \u0431\u0435\u0437 \u043f\u043e\u0440\u0442\u0430WEBAUTHN_RP_ID=example.com# \u0418\u043c\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0432\u0438\u0434\u0438\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0434\u0438\u0430\u043b\u043e\u0433\u0435 Face IDWEBAUTHN_RP_NAME=My App# \u041f\u043e\u043b\u043d\u044b\u0439 URL \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438WEBAUTHN_RP_ORIGIN=https:\/\/example.com\u0414\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438:WEBAUTHN_RP_ID=localhostWEBAUTHN_RP_NAME=My App DevWEBAUTHN_RP_ORIGIN=http:\/\/localhost:3000Pydantic Settings:from pydantic_settings import BaseSettingsclass Settings(BaseSettings):    # &#8230; \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#8230;    webauthn_rp_id: str = &#171;localhost&#187;    webauthn_rp_name: str = &#171;My App&#187;    webauthn_rp_origin: str = &#171;http:\/\/localhost:3000&#8243;settings = Settings()\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043e\u0448\u0438\u0431\u043e\u043a\u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u044c \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 \u2014 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f:from fastapi import HTTPExceptionclass AuthException(HTTPException):    &#171;&#187;&#187;\u0411\u0430\u0437\u043e\u0432\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043e\u043a \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.&#187;&#187;&#187;    def __init__(self, detail: str, status_code: int = 400):        super().__init__(status_code=status_code, detail=detail)class WebAuthnError(AuthException):    &#171;&#187;&#187;400 \u2014 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0440\u043e\u0442\u0443\u0445\u0448\u0438\u0439 challenge \u0438 \u0442.\u0434.&#187;&#187;&#187;    def __init__(self, detail: str = &#171;WebAuthn error&#187;):        super().__init__(detail=detail, status_code=400)class PasskeyNotFoundError(AuthException):    &#171;&#187;&#187;404 \u2014 passkey \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d \u0438\u043b\u0438 \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.&#187;&#187;&#187;    def __init__(self):        super().__init__(detail=&#187;Passkey not found&#187;, status_code=404)class UserNotFoundError(AuthException):    &#171;&#187;&#187;404 \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u043d\u0430\u0439\u0434\u0435\u043d.&#187;&#187;&#187;    def __init__(self):        super().__init__(detail=&#187;User not found&#187;, status_code=404)class UserNotActiveError(AuthException):    &#171;&#187;&#187;403 \u2014 \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0434\u0435\u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d.&#187;&#187;&#187;    def __init__(self):        super().__init__(detail=&#187;User account is deactivated&#187;, status_code=403)WebAuthnService \u2014 \u0432\u0435\u0441\u044c \u0441\u0435\u0440\u0432\u0438\u0441\u0412\u043e\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u0441\u0435\u0440\u0432\u0438\u0441. \u041a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u0448\u0430\u0433\u0435 \u2014 \u0447\u0442\u043e\u0431\u044b \u0431\u044b\u043b\u043e \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438 \u0437\u0430\u0447\u0435\u043c:&#187;&#187;&#187;WebAuthn \/ Passkeys \u2014 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 FIDO2.&#187;&#187;&#187;import jsonimport uuidfrom datetime import UTC, datetime, timedeltafrom sqlalchemy import delete, selectfrom sqlalchemy.ext.asyncio import AsyncSessionfrom sqlalchemy.orm import selectinloadfrom webauthn import (    generate_authentication_options,    generate_registration_options,    verify_authentication_response,&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-498160","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/498160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=498160"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/498160\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=498160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=498160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=498160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}