Registration and Login Page<\/figcaption><\/figure>\n\n\n\nFor access provisioning, I simply use a JSON file to bind the email address to the allowed web sites. Below is an example:<\/p>\n\n\n\n
{\n \"jdoe@gmail.com\": [\n {\n \"user\": \"John\",\n \"site\": \"https:\/\/site1.lufamily.ca\"\n }\n ],\n \"jane.doe@icloud.com\": [\n {\n \"user\": \"Jane\",\n \"site\": \"https:\/\/site1.lufamily.ca\"\n },\n {\n \"user\": \"Jane\",\n \"site\": \"https:\/\/site2.lufamily.ca\"\n }\n ]\n}<\/code><\/pre>\n\n\n\nWhen the user registers, they will receive an email looking like:<\/p>\n\n\n
\n
Sample onboarding or registration email<\/figcaption><\/figure>\n<\/div>\n\n\nIn the beginning, I wrote custom code on my web site to use my identity service. However I found out I can write an Apache Lua script to check for token provisioning and invoking of the identity service. This way I can add authentication to any sites that I host with Apache2 web server with a virtual host configuration that looks like this:<\/p>\n\n\n\n
<VirtualHost *:80>\n\n <Location \/ >\n LuaCodeCache forever\n LuaHookAccessChecker \/path\/to\/checkAuthLuFamily.lua handle\n\n RewriteEngine On\n\n RewriteCond %{ENV:token} ^$\n RewriteRule ^ https:\/\/auth.lufamily.ca\/register\/%{ENV:cbsite}\" [L,R=302]\n\n Header set Set-Cookie \"token=%{token}e; Max-Age=1800; Path=\/; HttpOnly; Secure; SameSite=Strict\" env=token\n <\/Location>\n\n<\/VirtualHost><\/code><\/pre>\n\n\n\nThe checkAuthLuFamily.lua<\/code> script is used to check if a token is provided either as an HTTP GET<\/code> parameter, Authorization Bearer<\/code> value, or a secure<\/code>, http-only<\/code> cookie. The token is actually a JWT token containing user specific attributes derived from the JSON file earlier. This token is provisioned when authentication is successful. If the token is missing, then this means the user has yet to be authenticated so we automatically redirect them to the registration page. If the token is valid, then the script will store a new refreshed token with extended expiry (another 30 minutes) into the environment variable which we use to reset the cookie. Any future requests to the same site will preserve the cookie\/token.<\/p>\n\n\n\nI love this flexibility. This means I can add authentication to any site that I host with Apache2 without changing the code or modifying the site. This also means that I can develop future sites and services without having to worry about authentication.<\/p>\n\n\n\n
I have not provided the source code here, because I am still testing it, but I wanted to document the concept and the approach, so that I can refer to my own creation in the future.<\/p>\n","protected":false},"excerpt":{"rendered":"
Over the past few years I have developed several services that can be accessed using a web site. Many if not all of these sites require authentication. In the past I have typically adopted a typical user id and password technique, and more recently an email based authentication along with the user’s external IP address, … Continue reading “WebAuthn with Email Implementation”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[111],"tags":[202,204,28,203],"class_list":["post-3381","post","type-post","status-publish","format-standard","hentry","category-tech","tag-apache2","tag-authentication","tag-technology","tag-webauthn"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p7V6i8-Sx","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/3381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/comments?post=3381"}],"version-history":[{"count":8,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/3381\/revisions"}],"predecessor-version":[{"id":3392,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/posts\/3381\/revisions\/3392"}],"wp:attachment":[{"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/media?parent=3381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/categories?post=3381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lufamily.ca\/kang\/wp-json\/wp\/v2\/tags?post=3381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/blog.lufamily.ca\/kang\/wp-content\/uploads\/sites\/3\/2026\/04\/Screenshot-2026-04-06-at-8.42.56-PM-1024x363.png\")
<\/a>