incorrect check on domain about webauthn HOT 3 CLOSED

If I understand the spec correctly, the check for the origin & rpIdHash are mandatory steps, but I think a simple fix would be to check the publicKey.rp.id rather than the name?

from webauthn.

Checking publicKey.rp.id would be an improvement, but the problem goes a bit further than that. My specific use case requires the registration and authentication to happen on a different subdomain of the same main domain (so registration on a.example.com, authentication on b.example.com). This is allowed per the spec, if you pass 'example.com' as the rp.id. In this case the check would always fail because 'https://'+key.publicKey.rp.id would result in 'https://example.com', while cd.origin will contain 'https://a.example.com'. As a result, the check would still fail.

from webauthn.

Using publicKey.rp.id vs publicKey.rp.name doesn't make a difference for this library as they are both the same (webauthn.php#L72). However, I agree it would make more semantic sense to compare publcKey.rp.id against the suffix of cd.origin

Edit

The code has been refactored and you can now find the same line link here:

from webauthn.