fix: use configured HTTPS origin for passkeys #223

Merged

erik merged 1 commit from fix/task-f2094dfb-webauthn-proxy-origin into main

2026-06-28 06:36:05 -05:00

erik commented

2026-06-28 06:33:09 -05:00

Owner

Summary

Make WebAuthn passkey registration/authentication prefer the configured site URL as the canonical origin when it is HTTPS.
Preserve localhost development by continuing to use the localhost request origin when no HTTPS site URL is configured.
Add regression tests for proxied HTTP requests with configured https://slugkit.com origins for both registration and login options.
Document the site URL requirement for passkeys behind TLS-terminating proxies.

Verification

npm exec --workspace @slugkit/template-site -- vitest run --config ./vitest.config.ts src/routes/tests/admin-passkeys.test.ts src/routes/tests/auth.test.ts
npm run typecheck --workspace @slugkit/template-site
npm run lint
./scripts/pre-pr.sh

Task: #task-f2094dfb

## Summary - Make WebAuthn passkey registration/authentication prefer the configured site URL as the canonical origin when it is HTTPS. - Preserve localhost development by continuing to use the localhost request origin when no HTTPS site URL is configured. - Add regression tests for proxied HTTP requests with configured `https://slugkit.com` origins for both registration and login options. - Document the site URL requirement for passkeys behind TLS-terminating proxies. ## Verification - npm exec --workspace @slugkit/template-site -- vitest run --config ./vitest.config.ts src/routes/__tests__/admin-passkeys.test.ts src/routes/__tests__/auth.test.ts - npm run typecheck --workspace @slugkit/template-site - npm run lint - ./scripts/pre-pr.sh Task: #task-f2094dfb

erik added 1 commit

2026-06-28 06:33:09 -05:00

fix: use configured HTTPS origin for passkeys

CI / build-lint-test (pull_request) Successful in 46s

Details

adbb003365

Task: #task-f2094dfb

erik commented

2026-06-28 06:34:52 -05:00

Author

Owner

Review summary

Approved.

Acceptance criteria

Passkey registration options store expected origin https://<public-host> when public origin is configured and internal request URL is HTTP. Evidence: registration option generation now derives RP origin from configured HTTPS site URL; test covers http://slugkit.com/settings/passkeys/options with configured https://slugkit.com and asserts stored challenge origin https://slugkit.com.
Passkey login/authentication options use the same public origin behavior. Evidence: authentication option generation uses the same relying-party helper; test covers http://slugkit.com/login/passkeys/options with configured https://slugkit.com and asserts stored challenge origin https://slugkit.com.
Tests cover proxied HTTP request + configured HTTPS public origin. Evidence: both registration and login route tests cover HTTP request URLs with configured HTTPS site URL.
Local development behavior remains supported. Evidence: registration and login tests cover http://localhost:3000 and assert localhost RP/origin behavior is preserved.

Blocking issues

None.

Warnings

None.

Verification reviewed

./scripts/pre-pr.sh passed locally.
Forgejo CI run #308 passed.
Diff reviewed with git diff --check main...HEAD.

Final verdict

Approved. Ready for human merge approval.

### Review summary Approved. ### Acceptance criteria - [x] Passkey registration options store expected origin `https://<public-host>` when public origin is configured and internal request URL is HTTP. Evidence: registration option generation now derives RP origin from configured HTTPS site URL; test covers `http://slugkit.com/settings/passkeys/options` with configured `https://slugkit.com` and asserts stored challenge origin `https://slugkit.com`. - [x] Passkey login/authentication options use the same public origin behavior. Evidence: authentication option generation uses the same relying-party helper; test covers `http://slugkit.com/login/passkeys/options` with configured `https://slugkit.com` and asserts stored challenge origin `https://slugkit.com`. - [x] Tests cover proxied HTTP request + configured HTTPS public origin. Evidence: both registration and login route tests cover HTTP request URLs with configured HTTPS site URL. - [x] Local development behavior remains supported. Evidence: registration and login tests cover `http://localhost:3000` and assert localhost RP/origin behavior is preserved. ### Blocking issues - None. ### Warnings - None. ### Verification reviewed - `./scripts/pre-pr.sh` passed locally. - Forgejo CI run #308 passed. - Diff reviewed with `git diff --check main...HEAD`. ### Final verdict Approved. Ready for human merge approval.

erik merged commit 6a4ef87709 into main

2026-06-28 06:36:05 -05:00

erik deleted branch fix/task-f2094dfb-webauthn-proxy-origin

2026-06-28 06:36:05 -05:00

erik referenced this pull request from a commit

2026-06-28 06:36:06 -05:00

Merge pull request 'fix: use configured HTTPS origin for passkeys' (#223) from fix/task-f2094dfb-webauthn-proxy-origin into main

erik referenced this pull request

2026-06-28 06:37:31 -05:00

Bug: WebAuthn passkeys derive http origin behind TLS proxy #215

erik referenced this pull request

2026-06-28 06:48:39 -05:00