3 ms·
> so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that. Nowhere in the spec did I see where ngrok.i
by qudat 5y ago
> so it doesn't mean anything to have "ngrok.io" credentials any more than for "com" and WebAuthn won't allow that.
Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation.
> I found it very easy to deploy WebAuthn securely, writing everything from scratch as a toy project to understand how it works
I’m glad you found it easy but judging by the fact that you implemented webauthn by yourself, your skill level is probably advanced. Furthermore, in my particular case I needed to support legacy u2f-api keys, which added to the complexity. The APIs are different, what they expect are different, and the third party libraries are different.
- hn_throwaway_99 5y agoNot an expert in this topic, but: ngrok.io is on the Public Suffix List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ This other comment says that WebAuthn uses the PSL in its definition of "registerable domains": https://news.ycombinator.com/item?id=24444476 https://news.ycombinator.com/item?id=24444476 Edit: yes, here is the part of the spec that says where you can't register public suffixes: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi...
- jeroenhd 5y ago> Nowhere in the spec did I see where ngrok.io should be excluded as a valid rp id, I looked pretty intently but could have missed something. Just like with localhost this was purely a way to cheaply get tls to simulate a more real implementation. It's in the spec, though you need to click a few links to get to the details. The WebAuthn spec (https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/) has the following in the terms defined by reference: > is a registrable domain suffix of or is equal to This references the following page: https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to https://html.spec.whatwg.org/multipage/origin.html#is-a-regi... Which contains a reference to a "public suffix": https://url.spec.whatwg.org/#host-public-suffix https://url.spec.whatwg.org/#host-public-suffix Which references the Public Suffic List: https://publicsuffix.org/list/ https://publicsuffix.org/list/ Which ngrok.io is on: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat So, this limitation is in the spec, it's just not immediately obvious if you skim through the spec to find the problem. The public suffix list ensures that you cannot accidentally share your authentication domain with others for all kinds of security measures, and WebAuthn is just one of those. Learning about the PSL and its uses (and applied limitations) is imperative if you write any kind of security-related web content, IMO.
- qudat 5y agoI must have missed that! I did meander my way to the public suffix list at some point but I must not have searched it properly. Thanks!