erik/slugkit.com

Fork 0

Bug: passkey registration uses http origin behind TLS proxy #11

New issue

Closed

opened 2026-06-27 11:39:21 -05:00 by erik · 3 comments

erik commented

2026-06-27 11:39:21 -05:00

Owner

Problem

Passkey registration fails on production slugkit.com because the server stores/verifies the WebAuthn expected origin as http://slugkit.com, while the browser correctly returns https://slugkit.com.

Observed pod log after retrying passkey registration on release 0.1.11:

slugkit auth: passkey registration failed {"route":"/settings/passkeys/register","status":"500","email":"erik@erikcraddock.me","errorName":"Error","errorMessage":"Unexpected registration response origin \"https://slugkit.com\", expected \"http://slugkit.com\""}

Likely cause: the app derives WebAuthn RP origin from the internal pod/proxy request URL (context.req.url) after TLS termination, rather than the public HTTPS origin.

Expected

Passkey registration on https://slugkit.com/settings/passkeys should verify against https://slugkit.com.

Scope

Fix slugkit.com origin derivation for passkey registration and login behind the k3s/Traefik TLS proxy.
Prefer an explicit configured public origin if available; otherwise safely honor trusted forwarded headers.
Avoid weakening WebAuthn validation.
Release and verify passkey registration works in production.

Acceptance criteria

Production passkey registration verifies expected origin https://slugkit.com.
Pod logs no longer show expected "http://slugkit.com" for passkey registration.
Existing magic-link login and settings access continue to work.
Fix is released and verified on slugkit.com.

## Problem Passkey registration fails on production slugkit.com because the server stores/verifies the WebAuthn expected origin as `http://slugkit.com`, while the browser correctly returns `https://slugkit.com`. Observed pod log after retrying passkey registration on release `0.1.11`: ```text slugkit auth: passkey registration failed {"route":"/settings/passkeys/register","status":"500","email":"erik@erikcraddock.me","errorName":"Error","errorMessage":"Unexpected registration response origin \"https://slugkit.com\", expected \"http://slugkit.com\""} ``` Likely cause: the app derives WebAuthn RP origin from the internal pod/proxy request URL (`context.req.url`) after TLS termination, rather than the public HTTPS origin. ## Expected Passkey registration on `https://slugkit.com/settings/passkeys` should verify against `https://slugkit.com`. ## Scope - Fix slugkit.com origin derivation for passkey registration and login behind the k3s/Traefik TLS proxy. - Prefer an explicit configured public origin if available; otherwise safely honor trusted forwarded headers. - Avoid weakening WebAuthn validation. - Release and verify passkey registration works in production. ## Acceptance criteria - Production passkey registration verifies expected origin `https://slugkit.com`. - Pod logs no longer show `expected "http://slugkit.com"` for passkey registration. - Existing magic-link login and settings access continue to work. - Fix is released and verified on slugkit.com.

erik added the

labels

2026-06-27 11:39:21 -05:00

erik commented

2026-06-27 11:44:57 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T16:40:56.108Z

Review update

PR: erik/slugkit.com#12 is open and reviewed.
Result: approved.
Follow-up: waiting for explicit human merge approval.
Acceptance criteria: code criteria are met; release/production retry remains after merge.

_Synced from todu comment by @todu on 2026-06-27T16:40:56.108Z_ ### Review update - PR: `erik/slugkit.com#12` is open and reviewed. - Result: approved. - Follow-up: waiting for explicit human merge approval. - Acceptance criteria: code criteria are met; release/production retry remains after merge.

erik commented

2026-06-27 14:26:55 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T19:24:06.768Z

Production verification

Released and deployed slugkit.com 0.1.13.
Verified user retested passkey creation successfully.
Recent pod logs no longer show the expected "http://slugkit.com" WebAuthn origin error.

_Synced from todu comment by @todu on 2026-06-27T19:24:06.768Z_ ### Production verification - Released and deployed slugkit.com `0.1.13`. - Verified user retested passkey creation successfully. - Recent pod logs no longer show the `expected "http://slugkit.com"` WebAuthn origin error.

erik

2026-06-27 14:32:30 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-27 14:32:31 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-27T19:29:00.130Z

Close gate

Readiness: READY

Evidence:

Production passkey registration now verifies against the public HTTPS origin: slugkit.com 0.1.13 is deployed and user retested passkey creation successfully.
Recent pod logs no longer show the expected "http://slugkit.com" WebAuthn origin error.
Existing access path remains usable: successful production retest of passkey creation from settings, plus prior review noted code criteria met with only release/production retry remaining.
Fix is released and verified on slugkit.com via deployed 0.1.13.

_Synced from todu comment by @todu on 2026-06-27T19:29:00.130Z_ ### Close gate Readiness: READY Evidence: - Production passkey registration now verifies against the public HTTPS origin: slugkit.com `0.1.13` is deployed and user retested passkey creation successfully. - Recent pod logs no longer show the `expected "http://slugkit.com"` WebAuthn origin error. - Existing access path remains usable: successful production retest of passkey creation from settings, plus prior review noted code criteria met with only release/production retry remaining. - Fix is released and verified on slugkit.com via deployed `0.1.13`.