Bug: WebAuthn passkeys derive http origin behind TLS proxy #215

New issue

Closed

opened 2026-06-27 12:07:12 -05:00 by erik · 2 comments

erik commented

2026-06-27 12:07:12 -05:00

Owner

Problem

WebAuthn passkey registration/login can fail behind TLS-terminating proxies because the app derives the expected RP origin from the internal request URL. In slugkit.com production, the pod received/derived http://slugkit.com while the browser correctly returned https://slugkit.com, causing verification failure.

Observed on slugkit.com:

Unexpected registration response origin "https://slugkit.com", expected "http://slugkit.com"

Expected

Passkey registration and login should verify against the public HTTPS origin when the app is deployed behind a proxy/ingress.

Scope

Update upstream/template passkey origin derivation so WebAuthn uses a canonical public origin when configured.
Consider explicit site/public origin config and/or trusted forwarded headers.
Preserve safe local development behavior for localhost.
Avoid weakening WebAuthn RP ID/origin validation.

Acceptance criteria

Passkey registration options store expected origin https://<public-host> when public origin is configured and internal request URL is HTTP.
Passkey login/authentication options use the same public origin behavior.
Tests cover proxied HTTP request + configured HTTPS public origin.
Local development behavior remains supported.

## Problem WebAuthn passkey registration/login can fail behind TLS-terminating proxies because the app derives the expected RP origin from the internal request URL. In slugkit.com production, the pod received/derived `http://slugkit.com` while the browser correctly returned `https://slugkit.com`, causing verification failure. Observed on slugkit.com: ```text Unexpected registration response origin "https://slugkit.com", expected "http://slugkit.com" ``` ## Expected Passkey registration and login should verify against the public HTTPS origin when the app is deployed behind a proxy/ingress. ## Scope - Update upstream/template passkey origin derivation so WebAuthn uses a canonical public origin when configured. - Consider explicit site/public origin config and/or trusted forwarded headers. - Preserve safe local development behavior for localhost. - Avoid weakening WebAuthn RP ID/origin validation. ## Acceptance criteria - Passkey registration options store expected origin `https://<public-host>` when public origin is configured and internal request URL is HTTP. - Passkey login/authentication options use the same public origin behavior. - Tests cover proxied HTTP request + configured HTTPS public origin. - Local development behavior remains supported.

erik added the

labels

2026-06-27 12:07:12 -05:00

erik commented

2026-06-28 06:37:31 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-28T11:34:55.381Z

Review update

PR: #223 is open with Forgejo CI passing.
Result: approved.
Follow-up: waiting for explicit human merge approval.

Acceptance criteria: 4/4 met. Blocking issues: 0. Warnings: 0.

_Synced from todu comment by @todu on 2026-06-28T11:34:55.381Z_ ### Review update - PR: https://forge.caradoc.com/erik/slugkit/pulls/223 is open with Forgejo CI passing. - Result: approved. - Follow-up: waiting for explicit human merge approval. Acceptance criteria: 4/4 met. Blocking issues: 0. Warnings: 0.

erik

2026-06-28 06:48:38 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-28 06:48:39 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-28T11:47:33.221Z

Closing summary

PR #223 was merged into main.
Local main is aligned with origin/main at merge commit 6a4ef87.
Prior review recorded Forgejo CI passing, approval, and acceptance criteria 4/4 met.

Acceptance criteria verified:

Passkey registration options store expected https://<public-host> origin when configured and internal request URL is HTTP.
Passkey login/authentication options use the same public-origin behavior.
Tests cover proxied HTTP request plus configured HTTPS public origin.
Local development behavior remains supported.

Closing task as done.

_Synced from todu comment by @todu on 2026-06-28T11:47:33.221Z_ ### Closing summary - PR #223 was merged into `main`. - Local `main` is aligned with `origin/main` at merge commit `6a4ef87`. - Prior review recorded Forgejo CI passing, approval, and acceptance criteria 4/4 met. Acceptance criteria verified: - Passkey registration options store expected `https://<public-host>` origin when configured and internal request URL is HTTP. - Passkey login/authentication options use the same public-origin behavior. - Tests cover proxied HTTP request plus configured HTTPS public origin. - Local development behavior remains supported. Closing task as done.