by Yubico

(DEPRECATED) Java server-side library for U2F

128 Stars 54 Forks Last release: 8 months ago (java-u2flib-server-0.19.9) Other 430 Commits 15 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

== java-u2flib-server

DEPRECATED: U2F has been superseded by[Web Authentication], and this project is superseded by[java-webauthn-server]. We recommend using WebAuthn instead for new deployments. This project will only receive bug fixes, and will not be developed further.

image:["Build Status", link=""] image:["Coverage Status", link=""]

Server-side[U2F] library for Java. Provides functionality for registering U2F devices and authenticating with said devices.

=== Dependency

Maven: [source, xml] com.yubico u2flib-server-core 0.19.9

Gradle: [source, groovy] repositories{ mavenCentral() } dependencies { compile 'com.yubico:u2flib-server-core:0.19.9' }

=== Example Usage NOTE: Make sure that you have read[Using a U2F library] before continuing.

[source, java]

private abstract Iterable getRegistrations(String username);

@GET public View startAuthentication(String username) throws NoEligibleDevicesException {

// Generate a challenge for each U2F device that this user has registered
SignRequestData requestData
    = u2f.startSignature(SERVER_ADDRESS, getRegistrations(username));

// Store the challenges for future reference requestStorage.put(requestData.getRequestId(), requestData.toJson());

// Return an HTML page containing the challenges return new AuthenticationView(requestData.toJson(), username);


@POST public String finishAuthentication(SignResponse response, String username) throws DeviceCompromisedException {

// Get the challenges that we stored when starting the authentication
SignRequestData signRequest
    = requestStorage.remove(response.getRequestId());

// Verify the that the given response is valid for one of the registered devices u2f.finishSignature(signRequest, response, getRegistrations(username));

return "Successfully authenticated!";


In the above example

will return the U2F devices currently associated with a given user. This is most likely stored in a database. See link:u2flib-server-demo[
] for a complete demo server (including registration and storage of U2F devices).

=== JavaDoc JavaDoc can be found at[].

=== Attestation The attestation module (

) enables you to restrict registrations to certain U2F devices (e.g. devices made by a specific vendor). It can also provide metadata for devices.

=== Serialization All relevant classes implement

, so instead of using
, you can use Java's built in serialization mechanism. Internally the classes use Jackson to serialize to and from JSON, and the ObjectMapper from Jackson can be used.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.