Embedding Browser-Verified Domain Hashes in WebAuthn Signatures Blocks Phishing Relays

Multi-factor authentication no longer guarantees account security against modern phishing campaigns. Attackers now routinely bypass SMS codes and authenticator apps using reverse proxies that relay credentials in real time. The defense that actually stops this is WebAuthn, a standard that strips the human out of the verification loop.[1][2]

By cryptographically binding the login to the browser's address bar, WebAuthn renders intercepted credentials mathematically invalid. The protocol does not rely on users spotting a fake domain or a subtle spelling change. Instead, it forces the browser to embed the exact origin into the signature payload.[1][5]

This mechanism, known as origin binding, is the foundation of passkeys and FIDO2 hardware security keys. While marketing materials often focus on the convenience of biometric unlocks, the structural security gain happens invisibly. The biometric simply unlocks a private key; the origin binding prevents that key from signing a fraudulent challenge.[2][3]

The World Wide Web Consortium (W3C) standardized this approach with WebAuthn Level 1 in 2019, and the protocol has since evolved through Level 2 in 2021. As organizations face rising adversary-in-the-middle (AiTM) attacks, understanding how this cryptographic boundary holds is essential. The vulnerability in traditional MFA is not the strength of the factor, but its portability.[1][6]

How Reverse Proxies Hijack Sessions

To understand why WebAuthn succeeds, one must examine how traditional multi-factor authentication fails. Phishing-as-a-Service toolkits like Tycoon 2FA and Evilproxy do not bother cracking passwords or guessing time-based codes. They simply insert an intermediary server between the victim and the legitimate identity provider.[2][6]

When a user clicks a phishing link, they land on an attacker-controlled reverse proxy, such as a lookalike domain. The proxy fetches the real login page from the target bank or enterprise service and displays it to the user. The site looks authentic because it is the actual site, merely piped through a hostile conduit.[2][5]

As the user types their password, the proxy captures the keystrokes and instantly forwards them to the legitimate server. When the server demands a six-digit authenticator code, the proxy relays that prompt back to the user. The user enters the code, and the proxy submits it to complete the challenge.[1][4]

"The attack flow is automated and seamless," notes Adaptive Security's 2026 deployment guide. "The victim lands on a phishing page that looks identical to a legitimate login portal, enters their username and password, and the attacker's backend immediately submits those credentials."

Once the legitimate server accepts the code, it issues a session cookie to keep the user logged in. The reverse proxy intercepts this cookie, saves a copy for the attacker, and passes it down to the victim. The attacker now holds a fully authenticated session, bypassing the MFA entirely.[2][5]

Replacing Secrets With Signatures

WebAuthn dismantles this attack path by abandoning shared secrets entirely. Passwords, SMS texts, and authenticator codes all share a fatal flaw: they are portable strings of data. If an attacker acquires the string, they can submit it from anywhere, and the server cannot distinguish the source.[1][4]

Instead of secrets, WebAuthn relies on asymmetric public-key cryptography. During registration, the user's authenticator—whether a smartphone secure enclave or a hardware key—generates a unique key pair. The private key remains permanently locked inside the device hardware.[1][3]

The public key is transmitted to the relying party, which is the server managing the application. When the user attempts to log in, the server does not ask for a password. It generates a random cryptographic challenge and sends it to the browser, demanding a signature from the corresponding private key.[4][5]

The user authorizes the signature locally, typically using a biometric prompt like Face ID or a device PIN. The authenticator signs the challenge and returns the payload to the server. Because the private key never leaves the device, an attacker cannot steal it from a database breach or intercept it in transit.[1][4]

Crucially, the signature proves possession of the key without revealing the key itself. The server verifies the response using the stored public key. If the math checks out, the authentication succeeds. But this challenge-response cycle alone does not stop a reverse proxy from relaying the challenge.[1][5]

How the Browser Traps the Proxy

The definitive defense against AiTM phishing lies in a specific WebAuthn property called origin binding. When the server sends the challenge, the browser intervenes before passing the data to the authenticator. The browser captures the exact domain currently displayed in the address bar.[1][6]

WebAuthn utilizes two distinct domain identifiers to forge this lock. The first is the Relying Party ID, a string chosen by the service during registration, typically the root domain. The authenticator hashes this ID into a 32-byte hash and embeds it in the signature.[4][6]

The second identifier is the Client Data Hash. The browser takes the challenge, the origin URL it actually sees, and other metadata, bundling them into a JSON object. It computes a SHA-256 hash of this object and hands it to the authenticator to sign alongside the Relying Party ID hash.[2][5]

If a user is tricked into visiting a proxy domain, the browser dutifully records that proxy as the origin. The reverse proxy relays the challenge from the real bank, but it cannot force the victim's browser to lie about its current address. The browser locks the fraudulent origin into the payload.[1][2]

When the proxy forwards the signed response to the legitimate bank, the server unpacks the data. It expects to see its own origin cryptographically sealed in the signature. Instead, it finds the proxy domain. The server immediately rejects the authentication, neutralizing the attack at the protocol level.[4][6]

Session Theft and Post-Login Risks

While WebAuthn provides an ironclad defense during the authentication ceremony, it does not solve every security challenge. The protocol ensures that an attacker cannot obtain a valid login signature from a mismatched domain. However, it does not protect the session after the login completes.[1][5]

If an organization implements WebAuthn but allows users to fall back to legacy passwords, attackers will simply target the weaker method. Maintaining transitional fallback methods leaves the credential replay vulnerability exposed, undermining the structural gains of the new protocol.[2][4]

Furthermore, if an attacker compromises the user's local device with malware, they can extract the session cookies directly from the browser cache. WebAuthn secures the entry door, but a stolen session cookie grants the attacker full access without needing to authenticate again.[5][6]

To mitigate this, high-assurance environments are exploring token-binding protocols that tie the session cookie to the specific device hardware. Until those standards mature, session hijacking remains a viable, albeit more difficult, avenue for sophisticated threat actors.[2][6]

The FIDO Alliance acknowledges these residual risks. In their 2025 deployment guidelines, they note that while passkeys prevent direct account compromise through phishing, compromised sessions can still allow attackers to perform actions on behalf of legitimate users.[2]

Deploying Phishing Resistance

Despite these post-login caveats, the transition to WebAuthn represents the most significant upgrade in web security in a decade. The FIDO Alliance reported in 2025 that 53 percent of surveyed users had enabled passkeys on at least one account, driven by major consumer platform rollouts.[2][6]

For enterprise technology leaders, the mandate is clear. The US Cybersecurity and Infrastructure Security Agency (CISA) now classifies FIDO2 and WebAuthn as the only fully phishing-resistant authentication standards. Legacy MFA is no longer considered sufficient for privileged access.[5][6]

Implementing this architecture requires careful engineering. Developers must rigorously validate the challenge values, the origin, the relying party ID hash, and the signature on the server side. A flawed server implementation that ignores the origin check completely negates the browser's protections.[1][4]

WebAuthn shifts the burden of security from human vigilance to cryptographic math. Users no longer need to scrutinize URLs for subtle typos, and IT departments no longer need to train employees to spot invisible reverse proxies. The protocol simply refuses to cooperate with a lie, closing the vulnerability that made credential relay possible.[1][6]