rpId mismatch / DOMException about webauthn-framework

[Cirrusware]

Ok thanks for this precision.
WebAuthn is now activated on my website. Thanks for your work.

I search a way to have only fingerprint without screen lock.
I read this
https://stackoverflow.com/questions/57279094/js-webauthn-how-to-disable-or-detect-screen-lock-pin-code-option
So maybe in the next release of Chrome.

Have a nice day :-)

[Cirrusware]

rpId must be equal to host.

Ex: https://www.domain.net => rpId = www.domain.net => Works
https://www.domain.net => rpId = api.domain.net => don't work

[Spomky]

Hi,

Either you don’t set the rpId i.e. the current domain is used or you set it on both attestation and assertion options.

I can see in the first options object it is not set ("rp":{"name":"xxxxx"}) but it is in the other one ("rp":{"name":"xxxxx","id":"xxxxx.net"}). This may be the reason for the exception.

I recommend to always set the domain to avoid any trouble. In your case and as you may have requests from www.domain.net or api.domain.net, you should set domain.net ("rp":{"name":"xxxxx","id":"domain.net"})

[Spomky]

As noted in the SO question, the uvm extension is the way to go.
When available, you should only need an extension handler and reject if other methods than fingerprint are present.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.