From 76446edd75a7e01641c2520bfb5ba8cff7478a27 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 4 Jul 2026 11:07:15 +0000 Subject: [PATCH] fleet-manager: allow multiple WebAuthn origins (comma-separated RP_ORIGIN) Passkeys bind to the exact scheme://host:port the browser used, so a single configured origin fails "Error validating origin" when reached via a different form (e.g. :9500 direct vs a 443 proxy). Split FLEET_MGR_RP_ORIGIN on commas so several exact origins can be allowed. Single-value config is unchanged. --- serving/fleet-manager/webauthn.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/serving/fleet-manager/webauthn.go b/serving/fleet-manager/webauthn.go index bc460ed..6500a8d 100644 --- a/serving/fleet-manager/webauthn.go +++ b/serving/fleet-manager/webauthn.go @@ -15,6 +15,7 @@ import ( "fmt" "os" "path/filepath" + "strings" "sync" "time" @@ -191,9 +192,18 @@ func newWebAuthn(cfg config) (*webauthn.WebAuthn, error) { if cfg.rpID == "" || cfg.rpOrigin == "" { return nil, fmt.Errorf("WebAuthn needs FLEET_MGR_RP_ID and FLEET_MGR_RP_ORIGIN (the admin UI hostname/origin)") } + // FLEET_MGR_RP_ORIGIN may list several exact origins (comma-separated) — e.g. + // the direct :9500 form and a 443-proxy form — since passkeys bind to the + // exact scheme://host:port the browser used. Each must match a real origin. + var origins []string + for _, o := range strings.Split(cfg.rpOrigin, ",") { + if o = strings.TrimSpace(o); o != "" { + origins = append(origins, o) + } + } return webauthn.New(&webauthn.Config{ RPID: cfg.rpID, RPDisplayName: cfg.rpDisplayName, - RPOrigins: []string{cfg.rpOrigin}, + RPOrigins: origins, }) }