Beyond the Passwordless Fortress: Building a Hybrid Passkey Strategy in Symfony 7.4

In Part 1 of this series, we explored the “holy grail” of modern authentication: a 100% passwordless application. We stripped away passwords, hashes and reset emails, replacing them with the cryptographic elegance of the WebAuthn API. But the real world is rarely that clean. You have legacy users who trust their password managers more than their biometrics. You have corporate environments where security keys aren’t yet standard. Most importantly, you have the “Transition Period” — that awkward phase where you need to support the old while aggressively pushing the new. Today, we are building the Hybrid Model. We’re going to create a single, intelligent login form that automatically detects if a user has a Passkey, triggers biometrics if available, but gracefully falls back to a traditional password when necessary. We’ll also look at Conditional Mediation (Passkey Autofill) — the “magic” UX that allows a user to log in simply by focusing an input field. The Tech Stack To follow this guid