Make WebAuthn relying-party configurable via environment#511
Open
FinanceAlex wants to merge 1 commit into
Open
Make WebAuthn relying-party configurable via environment#511FinanceAlex wants to merge 1 commit into
FinanceAlex wants to merge 1 commit into
Conversation
config.exs hardcodes rp_id/origin to loopctl.com, so the WebAuthn enrollment ceremony fails on any other origin (localhost, self-hosted domains). Allow overriding via WEBAUTHN_RP_ID / WEBAUTHN_ORIGIN at runtime; without the env vars behaviour is unchanged. Refs mkreyman/loopctl issue 494 (comment about the WebAuthn hardcode).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #494 (the WebAuthn hardcode noted in the issue comments).
config.exshardcodes the WebAuthn relying-party (rp_id/origin) toloopctl.com, so the enrollment ceremony fails on any other origin — localhost or a self-hosted domain.Change: allow overriding via
WEBAUTHN_RP_ID/WEBAUTHN_ORIGINenv vars inruntime.exs. Without the env vars, behaviour is exactly as before (the block is skipped entirely), so cloud deployments are unaffected.Testing: running in my self-hosted deployment since 2026-07-22 (
WEBAUTHN_RP_ID=localhost, enrollment ceremony works). Compile-checked against currentmasterwith the Dockerfile's build image.