What are Passkeys?

Passkeys are a modern replacement for passwords, built on the WebAuthn standard, that let users sign in with a cryptographic key bound to their device. They're phishing-resistant, can't be reused across sites, and eliminate entire classes of credential theft attacks that plague password-based authentication.

The catch: passkeys solve authentication, but they don't protect the authenticated session. Once a user has signed in, the application still runs in a browser where untrusted code can do significant damage if it ever gets a foothold.

What's the risk?

If a Cross-Site Scripting (XSS) vulnerability exists anywhere in your application, an attacker doesn't need to steal the passkey — they just need to ride the session the user already opened with it. Injected JavaScript can perform any action the legitimate user can, including transferring funds, exfiltrating sensitive data, or tampering with transactions as they happen.

Worse, injected code can call the WebAuthn API directly. That opens the door to silently registering an attacker-controlled passkey on the victim's account for persistent access, or triggering a fresh publickey-credentials-get ceremony to authorise a malicious action the user didn't intend.

Content Security Policy is a web platform mechanism designed to mitigate cross-site scripting, the top security vulnerability in modern web applications.

- Weichselbaum et al., Google Research

How we can help

Passkeys give your users strong authentication, but the browser-side security of the session they open is up to you. Two browser-native controls close the gap: a strict Content Security Policy that blocks injected JavaScript from running in the first place, and a Permissions Policy that locks publickey-credentials-create and publickey-credentials-get down to (self) so only your own origin can invoke the WebAuthn API.

Report URI helps you deploy both, monitor them in production, and catch violations the moment they happen.

Passkeys and XSS: A Security Analysis

Download our in-depth whitepaper on how Cross-Site Scripting undermines passkey-protected sessions, and what you can do about it with Content Security Policy and Permissions Policy.

Download the whitepaper Start 30-Day Free Trial

Content Security Policy

A well-configured Content Security Policy is the single most effective defence against XSS. By telling the browser exactly which scripts, styles, and connections are allowed, a strict CSP stops injected code from ever executing — which means there's nothing there to abuse your user's authenticated passkey session.

Report URI makes it easy to deploy and iterate on a CSP. Our CSP Builder gets you started, the CSP Wizard inventories everything running on your site, and our reporting backend surfaces any violation the moment a browser reports it — so you can tighten your policy with confidence.

Permissions Policy

Permissions Policy lets you lock down powerful browser features that your application either doesn't use, or only uses from its own origin. For passkeys, setting publickey-credentials-create=(self) and publickey-credentials-get=(self) ensures that only your own code can trigger the WebAuthn API — a cross-origin iframe or injected third-party script can't quietly enrol a new passkey or authorise an action on the user's behalf.

Permissions Policy violations are delivered as Reporting API reports, and Report URI's Permissions Policy product ingests them alongside every other browser-level security event. You see violations as they happen, so you can respond before an issue becomes an incident.

Defence in depth

Passkeys are a huge step forward for authentication, but the attack surface inside the browser doesn't go away just because the login is stronger. Real security comes from stacking controls: passkeys at the front door, a strict CSP watching the session, and a tight Permissions Policy closing off the WebAuthn API to anything that isn't your own code.

Report URI gives you the reporting and monitoring to make those controls actually work in production, not just in theory.

Start 30-Day Free Trial

Passkeys Protection