Allow explicit local WebAuthn ports

2026-09-03 22:30:23 -04:00
parent d8b09c8ae5
commit 17bd9453e2
8 changed files with 63 additions and 11 deletions
@@ -9,6 +9,11 @@ authorization decisions, session cookie, HTML, and local recovery command.
 ## Fixed security policy

 - Use an exact HTTPS origin whose hostname equals the relying-party ID.
+- Keep production origins portless. For local development only,
+  `AllowDevelopmentPort` permits one explicit non-default port when the RP ID
+  is exactly `localhost` or beneath the reserved `.test` top-level domain. The
+  configured origin, browser `Origin`, and WebAuthn verifier origin must still
+  match exactly.
 - Reject cross-origin ceremonies.
 - Require discoverable credentials and user verification.
 - Request no attestation conveyance.