Virtual Authenticator

Simulate hardware security keys (WebAuthn) for passwordless login testing.

Concept

Testing Two-Factor Authentication (2FA) or Biometrics usually requires physical hardware. Selenium 4 introduces the Virtual Authenticator API to simulate these devices (like YubiKeys or TouchID) directly in the browser.

Bypass the need for physical USB keys during tests.
Test successful authentication flows.
Test failure scenarios (e.g., user denies request).

What is WebAuthn?

A web standard for secure authentication using public key cryptography. It replaces passwords with more secure credentials like biometrics or security keys.

Selenium's Role

Selenium can create a "Virtual Authenticator" attached to the browser session. You can configure it to simulate user consent, verification, and protocol types (CTAP2, U2F).

Browser Support

Virtual Authenticator is primarily supported in Chromium-based browsers (Chrome, Edge) and requires the page to be served over HTTPS (or localhost).

Interactive Practice

WebAuthn Simulator

Click the button to trigger the WebAuthn request. Selenium will intercept this!

Java Code Example

WebAuthnTest.java

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
HasVirtualAuthenticator virtualAuthManager = (HasVirtualAuthenticator) driver;

VirtualAuthenticatorOptions options = new VirtualAuthenticatorOptions()
        .setProtocol(VirtualAuthenticatorOptions.Protocol.CTAP2)
        .setTransport(VirtualAuthenticatorOptions.Transport.USB)
        .setHasResidentKey(true)
        .setHasUserVerification(true)
        .setIsUserVerified(true)
        .setIsUserConsenting(true);

VirtualAuthenticator authenticator =
        virtualAuthManager.addVirtualAuthenticator(options);

driver.findElement(By.id("checkAuthBtn")).click();

System.out.println("Result: " + driver.findElement(By.id("authStatus")).getText());

virtualAuthManager.removeVirtualAuthenticator(authenticator);

driver.quit();

Code Breakdown

virtualAuthManager.addVirtualAuthenticator(options): Attaches the configured virtual authenticator. WebAuthn calls will now interact with this simulated key.
setIsUserConsenting(true): Simulates that the user accepts the WebAuthn prompt automatically.
virtualAuthManager.removeVirtualAuthenticator(auth): Detaches the virtual security key. Always do this to clean up.

Pro Tip

Lifecycle

Treat the virtual authenticator like any other test fixture: create → use → remove in the same test.

Test Failure

Always verify both success (with virtual key) and failure (without it) to fully test your flow.

HTTPS Required

Remember: WebAuthn only works on HTTPS or localhost and mainly in Chromium-based browsers.