jeffemmett
/
rspace-online
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: prioritize ridentity.online in WebAuthn Related Origins 

Browsers enforce a 5 eTLD+1 limit on Related Origins. The previous
config dumped all 29 r*.online domains, causing ridentity.online to
be ignored (position 15). Now only lists the 5 domains that actually
need passkey auth: ridentity, rsocials, crypto-commons, p2pfoundation,
rwallet.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeff Emmett 2026-03-09 16:37:47 -07:00
parent 9c74bff465
commit b6bc1a756a
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/encryptid/server.ts
View File

@ -367,14 +367,22 @@ app.use('*', cors({
// ============================================================================ // ============================================================================
// Serve .well-known/webauthn for Related Origins // Serve .well-known/webauthn for Related Origins
// Only list non-rspace.online origins here — *.rspace.online subdomains are // Browsers enforce a 5 eTLD+1 limit. Only list domains where passkey
// automatically valid because rspace.online is the RP ID. // ceremonies happen directly (OIDC authorize, admin pages).
// Keep to max 5 eTLD+1 labels to stay within browser limits. // *.rspace.online subdomains work automatically (RP ID = rspace.online).
app.get('/.well-known/webauthn', (c) => { app.get('/.well-known/webauthn', (c) => {
const nonRspaceOrigins = CONFIG.allowedOrigins.filter( // Priority origins — these domains actually trigger passkey auth in-browser.
o => o.startsWith('https://') && !o.endsWith('.rspace.online') && o !== 'https://rspace.online' // Each unique eTLD+1 counts toward the 5-origin limit.
); const origins = [
return c.json({ origins: nonRspaceOrigins }); 'https://ridentity.online', // OIDC authorize + admin (eTLD+1 #1)
'https://auth.ridentity.online',
'https://rsocials.online', // Postiz ecosystem (eTLD+1 #2)
'https://demo.rsocials.online',
'https://socials.crypto-commons.org', // (eTLD+1 #3)
'https://socials.p2pfoundation.net', // (eTLD+1 #4)
'https://rwallet.online', // (eTLD+1 #5)
];
return c.json({ origins });
}); });
// Health check — includes database connectivity // Health check — includes database connectivity