WebAuth disabled cannot set devices anymore

[XsniferX]

Describe the bug

i was running v3.xx in docker (on unraid) i had multiple webauth devices setted up.

since the upgrade to v4 all my devices are lost and cannot add them back.

i can only log in with email + passwd

Additional context

{message: "Attestation Error: Relying Party ID not scoped to current.",…}
errors
:
{attestation: ["Attestation Error: Relying Party ID not scoped to current."]}
attestation
:
["Attestation Error: Relying Party ID not scoped to current."]
message
:
"Attestation Error: Relying Party ID not scoped to current."

---

Request URL:
https://chris.2fa.axxh.com/webauthn/register
Request Method:
POST
Status Code:
422
Remote Address:
[2a0x:f480:1x00:aff:5x0a:3xce:6xf:51x8]:443
Referrer Policy:
strict-origin-when-cross-origin

[Bubka]

Hi,

How is set the WEBAUTHN_ID var in your .env file?
It should be set according to https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id

[XsniferX]

Hi, previously the variable was not set. so i just added. but now istead of getting back to register another webauth device now i have a error.

my site is accessible behind a reverse proxy (nginx proxy manager) is accesible at : john.2fa.exemple.com so i now set my WEBAUTHN_ID is set as "john.2fa.exemple.com"

[Bubka]

Please prefix WEBAUTHN_ID with https:// to have https://john.2fa.exemple.com

[XsniferX]

i tried to set it as 'https://john.2fa.exemple.com' and 'http://john.2fa.exemple.com' but i have now a error message i also have those error can they be related to the issue ?

also a image of my npm settings.

[Bubka]

Does your APP_URL var equals https://john.2fa.exemple.com/?

[XsniferX]

yup

[XsniferX]

here the settings
but now with the error in red

[Bubka]

There is an issue with custom WEBAUTHN_ID values (I'm going to open an issue on the webauthn package repo) so for now please set it back to null. Like so it will be fallbacked to the value of APP_URL.

The Relying Party ID not scoped to current error is triggered when the domain of the running 2FAuth instance does not match the domain set in the WEBAUTHN_ID|APP_URL var.

Can you please confirm that you have all vars set up as:

In your env var declaration:
APP_URL=https://john.2fa.exemple.com
WEBAUTHN_ID=null // (beware, not empty or '', must be null)

The URL of your 2FAuth instance is https://john.2fa.exemple.com

[XsniferX]

your are awesome !! with your last instruction it working now. i was able to register one key for the moment.

[ajatoledo]

@Bubka thanks for providing the workaround; worked to resolve my issue too. Thanks!

[Bubka]

There is an issue with custom WEBAUTHN_ID values (I'm going to open an issue on the webauthn package repo)

For the record: Laragear/WebAuthn#50