Using SimpleWebAuthn in different subdomains

[igorschechtel]

Can SimpleWebAuthn be used in different subdomains? For example:

• register from app.example.com
• authenticate from connect.example.com

I tried setting the rp id to example.com and the expectedOrigin to an array with both subdomains, but it didn't work...

[hwhmeikle]

I think this should work with the following values:

rpID: example.com,
expectedOrigin: ['https://app.example.com', 'https://connect.example.com']

[MasterKale]

Ah, apologies for the delayed response @igorschechtel. When you say "it didn't work," what error were you seeing?

If you specify the RP ID "example.com" both during registration and authentication then you would be able to register a single credential that you could then use across both subdomains.

It's when you omit an RP ID during registration that the RP ID is set by the browser to the effective domain, e.g. "app.example.com", which would scope the credential to that specific sub domain. You could not then use that credential to authenticate on https://connect.example.com

[lukepolo]

i ran into something similar. While setting rpID to example.com works, the pass key seems to be saved at the domain that you register at.

for instance, if i create a passkey at blah.example.com , configuration wies everything works, until you get to blah2.example.com my device is unable to find the passkey.

Is there a way to make sure to store the passkey at example.com?

[MasterKale]

If you set rp.id to "example.com" when calling startRegistration() then your key should be associated with "example.com". So long as you specify that same "example.com" for rp.id when logging into, say, blah.example.com then you should have no problem using your passkey. If your rp.id is "blah.example.com" for whatever reason (maybe rpID was omitted when calling generateAuthenticationOptions() so the browser defaults to assuming "blah.example.com" is the RP ID) then I can see your issue happening.

[lukepolo]

Ha I did a dumb thing , I thought I set environment variables , but I didn’t . they were undefined .

[MasterKale]

I'm glad to hear you figured it you! Fortunately it was something simple this time 😮‍💨