webauthn-ruby icon indicating copy to clipboard operation
webauthn-ruby copied to clipboard

RelyingParty#id should default to the domain of #origin

Open asavageiv opened this issue 4 months ago • 3 comments

Per the spec the RP ID "must be equal to the origin's effective domain, or a registrable domain suffix of the origin's effective domain." and "By default, the RP ID for a WebAuthn operation is set to the caller’s origin's effective domain."

I was surprised that setting the origin did not automatically set the ID if it was unset. This led to failures when my Android client didn't receive an ID.

Can we set the ID by default per the spec?

asavageiv avatar Apr 26 '24 23:04 asavageiv