Allow explicit local WebAuthn ports

2026-09-03 22:30:23 -04:00
parent d8b09c8ae5
commit 17bd9453e2
8 changed files with 63 additions and 11 deletions
@@ -49,3 +49,8 @@ application concern belongs in the shared module.
  passkey and replacement code digests. `authrecovery.BeginPasskey` and
  `FinishPasskey` now provide that boundary without creating an authenticated
  session; Gamertan keeps the raw grant only in a short-lived HttpOnly cookie.
+- A portless-only WebAuthn origin rule made an unprivileged local HTTPS
+  exercise impossible even though WebAuthn origins include ports. The passkey
+  service now permits an explicit development port only when applications opt
+  in and the RP ID is `localhost` or reserved `.test`; production origins keep
+  the original portless default.