Added rpId to webauthnAssertAuthentication expectations

This allows for authentication from subdomains. Fido2Lib.assertionResult compares the rpIdHash returned by the users browser, and since the key is created on the main domain it can't use the passed in origin for the hash comparison. 

The related Fido2Lib line: a5003fa5bf/lib/validator.js (L437)
This commit is contained in:
jissepo 2022-05-24 11:43:19 +03:00 committed by GitHub
parent 46961586c5
commit fda7f199ad
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -2713,7 +2713,8 @@ class UserHandler {
factor: 'either',
publicKey: credentialData.publicKey,
prevCounter: credentialData.counter,
userHandle: null
userHandle: null,
rpId: config.webauthn.rpId
};
const f2l = new Fido2Lib(Object.assign({}, config.webauthn));