Implement WebAuthn registration and authentication ceremonies server-side, including attestation and assertion verification, per the current W3C spec

Steps

1. For registration, generate a random challenge server-side, call navigator.credentials.create() client-side with the relying party ID, user info, and supported public key algorithms, then send the resulting attestation object and client data back to the server.
2. Server-side, verify the registration response: recompute and compare the challenge, verify the origin and relying-party-ID hash, parse the attestation statement format, and validate the certificate chain if your policy requires attestation trust.
3. Store the credential's public key, credential ID, sign count, and supported transports against the user account once verification succeeds.
4. For authentication, generate a new challenge and call navigator.credentials.get(); server-side, verify the assertion's signature against the stored public key, check challenge/origin/relying-party-ID match, and confirm the signature counter behavior.
5. Use a maintained server-side WebAuthn library for your language rather than hand-rolling verification, since the spec defines many detailed checks across both ceremonies.