Web-Only Credential Recovery
High-Assurance Re-Enrollment Through Mobile Browsers
Enable self-service credential recovery without app installation. Leverage modern web APIs—WebAuthn, Digital Credentials, and browser-based identity verification—to deliver enterprise-grade security through any mobile browser.
The Passwordless Recovery Challenge
In a passwordless environment, traditional "reset your password" flows no longer apply. When users lose their primary authenticator, a poorly implemented recovery process can undermine all security gains—falling back to phishable SMS codes or email links.
Identity Assurance Gap
Without an existing authenticator, the system must establish identity from scratch using high-assurance proofing methods.
No Trusted Device
Users may have lost their enrolled device. The solution must leverage browser APIs to achieve similar security.
Enterprise Integration
Recovery must interface with corporate directories and update credentials through provided SDK hooks.
User Experience
Remote identity proofing can be cumbersome. Clear guidance and real-time feedback are critical to success.
No App Installation
Some environments restrict apps, or users simply don't have one installed at lockout time.
Attack Surface
The recovery portal itself could be targeted. Robust anti-spoofing and anti-automation are essential.
End-to-End Recovery Workflow
From accessing the recovery portal to provisioning new hardware-bound credentials, every step is designed for maximum security and user clarity.
Access Portal
Navigate to recovery URL
Document Scan
Capture government ID
Selfie Capture
Live facial verification
Liveness Check
Anti-spoofing detection
Identity Match
Verify against records
Policy Check
Enforce org policies
Passkey Creation
WebAuthn enrollment
Revoke Old Creds
Invalidate lost factors
Portal Access & Document Capture
User navigates to a dedicated public recovery URL (e.g., recover.company.com) on their mobile browser. After identifying themselves via username or personalized link, the portal requests camera permission to scan their government-issued photo ID using HTML5 getUserMedia.
Selfie Capture & Liveness Detection
The portal prompts a live selfie with face alignment guidance. Liveness detection (ISO 30107-3 certified) verifies the sample is from a physically present person—analyzing eye reflections, 3D movement, and presentation attack indicators to defeat photos, videos, and deepfakes.
Identity Match & Policy Evaluation
Verified identity attributes (name, DOB) are matched against corporate records (AD/HRIS). The system enforces organizational policies—requiring higher assurance levels or secondary approval for privileged accounts before proceeding.
WebAuthn Enrollment & Revocation
The portal invokes navigator.credentials.create() to register a new FIDO2 passkey in the device's Secure Enclave/TEE. The private key never leaves the device. All previously registered authenticators are revoked simultaneously to prevent misuse of lost credentials.
Browser-Based Identity Verification
Modern mobile browsers provide powerful APIs for camera access, biometric authentication, and hardware security—enabling high-assurance identity proofing without native apps.
Secure Enclave / TEE
Hardware-isolated key storage
Biometric Sensor
Face ID / Touch ID / Fingerprint
NFC Reader
ePassport chip verification (Android)
Core Verification Methods
Live Document Capture
HTML5 getUserMedia enables seamless camera access. The captured ID image is analyzed for security features, holograms, text consistency, and compared against known document templates for forensic verification.
Biometric Facial Matching
The captured selfie is compared to the ID photo using facial recognition algorithms with high-threshold matching. This confirms the person holding the ID is the legitimate owner, preventing use of stolen documents.
Liveness Detection
ISO/IEC 30107-3 certified algorithms analyze skin texture, eye reflections, 3D movement, and challenge-response actions. Passive and active liveness techniques defeat photos, pre-recorded videos, and synthetic deepfakes.
Enhanced Verification Options
NFC ePassport Reading
On supported Android devices, Web NFC can read the embedded chip of ePassports containing digitally-signed holder data. This provides government-grade verification with cryptographic proof of document authenticity.
Digital ID Wallets
The W3C Digital Credentials API enables Safari (iOS 17+) to request verified identity info from mobile driver's licenses in Apple Wallet. Users consent via Face ID, and issuer-signed data is shared directly—no document scanning required.
WebAuthn Hardware Binding
navigator.credentials.create() generates FIDO2 passkeys stored in the device's Secure Enclave/TEE. The private key never leaves hardware, and biometric unlock (Face ID, fingerprint) provides the "something you are" factor.
Digital ID Wallet Integration
Leverage cryptographically-verified digital credentials stored in Apple Wallet or Android Wallet for the fastest, highest-assurance identity verification experience.
Apple Wallet
iOS 17+ Digital ID
Android Wallet
Identity Credential API
Cross-Device QR Handoff
For users on non-iOS browsers, Safari's Digital Credentials API supports an inter-device flow: display a QR code on the recovery page that the user scans with their iPhone to share their digital ID info. This enables cross-platform capability while maintaining the security benefits of hardware-backed credentials.
Defense-in-Depth Security Architecture
Multiple layers of security controls protect the recovery process from session hijacking, replay attacks, XSS, and device compromise.
DPoP Token Binding
OAuth 2.0 Demonstration of Proof-of-Possession cryptographically ties tokens to the browser instance. Stolen tokens are useless without the device's private key.
Content Security Policy
Strict CSP allows only approved scripts, blocking XSS and injection attacks. Sandbox attributes isolate third-party verification widgets.
Device Attestation
WebAuthn attestation statements indicate authenticator model and certification level. Play Integrity/DeviceCheck detect rooted or compromised devices.
Session Nonces & CSRF
Single-use tokens protect against replay. CSRF tokens prevent malicious sites from posting data to the recovery portal.
Rate Limiting
Throttled verification attempts prevent brute force. Suspicious activity triggers lockout and security alerts.
Audit Logging
Every event is logged with cryptographic evidence. SIEM integration enables anomaly detection and compliance reporting.
Browser Compatibility Matrix
The solution uses progressive enhancement: advanced APIs are used where available, with graceful fallbacks ensuring broad compatibility across all modern mobile browsers.
| Feature | Safari (iOS) | Chrome (Android) | Firefox | Edge |
|---|---|---|---|---|
| WebAuthn / Passkeys | ||||
| Camera Access (getUserMedia) | ||||
| Digital Credentials API | ||||
| Web NFC (ePassport) | ||||
| Secure Enclave / TEE | ||||
| DPoP Token Binding |
Platform-Specific Considerations
iOS / Safari
- • Digital Credentials API for Apple Wallet IDs (iOS 17+)
- • No Web NFC support—document scan fallback required
- • WebAuthn with Secure Enclave passkeys fully supported
Android / Chrome
- • Web NFC available for ePassport chip reading
- • Digital Credentials API emerging support
- • WebAuthn with TEE-backed passkeys fully supported
Enterprise SDK Integration
Delivered as a JavaScript SDK with backend reference code, the solution integrates seamlessly with your existing identity infrastructure—Active Directory, HRIS, and credential registries.
Frontend SDK
JavaScript components for camera capture, WebAuthn, and Digital Credentials API interactions.
Backend Reference
Server-side code for identity verification, policy enforcement, and credential management.
Enterprise Hooks
Integration points for AD/HRIS lookup, policy evaluation, and credential registry updates.
Integration Capabilities
- Account lookup via AD/HRIS with attribute matching
- Configurable identity assurance level requirements
- Policy hooks for approval workflows
- Credential registry updates (FIDO2, QR factors)
- Automatic revocation of compromised authenticators
- Federation claim updates (SAML/OIDC assurance levels)
Audit & Compliance
- Complete verification event logging
- Hashed document reference storage
- Identity assurance level tagging
- SIEM integration for anomaly detection
- GDPR-compliant data handling
- Configurable evidence retention policies
Web-Only Vs. Legacy Recovery
Traditional web recovery relies on phishable channels and weak verification. Our web-only solution delivers app-level security through modern browser APIs.
Legacy Web Recovery
- Email/SMS reset links (phishable)
- Security questions (guessable)
- No biometric verification
- Password-based re-enrollment
- No device binding
Web-Only High-Assurance
- Government ID + biometric verification
- Liveness detection (ISO 30107-3)
- WebAuthn passkey enrollment
- Hardware-bound credentials
- DPoP token binding + CSP
Identity Assurance
Phishing Resistance
Device Binding
Why Native App Remains The Stronger Option
While web-only recovery provides excellent accessibility and convenience, native mobile apps offer measurably stronger security guarantees for high-risk recovery scenarios.
| Security Area | Mobile Web (Browser) | Native Mobile App |
|---|---|---|
| Phishing Resistance | User can be tricked into look-alike sites; mitigations help but browser is inherently URL-driven | App distribution + deep link controls reduce spoofing surface significantly |
| Client Integrity Attestation | Very limited: web apps can't strongly prove untampered client code | Strong: iOS App Attest and Android Play Integrity provide cryptographic proof |
| Device Integrity / Posture | Weak access to managed-device posture; mostly indirect signals | Stronger options: consume device integrity and attestation signals directly |
| Hardware-Backed Key Storage | WebCrypto generates keys but can't guarantee hardware-backed storage | Non-exportable keys in Keychain/Keystore with Secure Enclave/TEE protection |
| Token Replay Protection | DPoP possible but key storage is browser-managed, not guaranteed hardware-backed | DPoP/mTLS with keys bound to Secure Enclave/TEE for strongest protection |
| Certificate Pinning | Websites can't reliably pin certs; HPKP is deprecated/obsolete | Apps can implement stricter trust evaluation and pinning controls |
| NFC / ePassport Reading | Limited: Safari iOS has no support; Web NFC can't do low-level operations | Full ISO 7816 APDU exchange support via Core NFC (iOS) and NFC frameworks (Android) |
| Digital ID / Wallet | Improving: W3C Digital Credentials API in Safari/WebKit | Strong: native integration with Verify with Wallet and platform mechanisms |
| UI Security / Anti-Overlay | Harder to guarantee; browser UI shared with other contexts | Lock down screens, use OS secure prompts, reduce UI spoofing |
Five Reasons Native App Delivers Stronger Security
1. Provable Client Integrity
iOS App Attest validates requests from genuine app instances. Android Play Integrity confirms genuine app + certified device and detects tampering. Web portals lack equivalent standardized client integrity proof.
2. Stronger Device Binding
Apps store enrollment control keys in Secure Enclave/TEE-backed storage and sign DPoP proofs with hardware-protected keys. In mobile web, DPoP keys are browser-managed without guaranteed hardware backing.
3. Superior NFC/ePassport IDV
Native apps access Core NFC with full ISO 7816 APDU exchange for passport chip reading. Web NFC is limited and unsupported on iOS Safari, making highest-assurance IDV asymmetric across platforms.
4. Channel Hardening Options
Apps implement stricter server trust evaluation and certificate pinning via Android Network Security Config and iOS manual trust evaluation. Web apps can't rely on in-app pinning—HPKP is deprecated.
5. Reliable Secure UX
Native apps protect recovery UX from replication or overlay attacks, anchoring sensitive actions behind OS-controlled biometric prompts. Web portals can mitigate risks but cannot fully control the browsing environment.
Practical Positioning
Native app: Primary path when you need strongest guarantees.Mobile web: Valuable fallback when app install is impossible, relying more on strong IDV and WebAuthn.
Need Maximum Security?
For environments requiring the highest security guarantees, explore our native mobile app recovery solution with full hardware attestation and Secure Enclave integration.
Enable Secure Self-Service Recovery
Deploy high-assurance credential recovery through any mobile browser. No app installation required—just enterprise-grade security.