WebAuthn/U2F: Attestation Error: Relying Party ID not scoped to current

[nicokaiser]

Detailed description of the problem [REQUIRED]

WebAuthn does not work.

Steps to reproduce the issue

Steps to reproduce the behavior:

1. Log in
2. Open Settings -> U2F
3. Click "Register new device"
4. Have the browser generate a new passkey
5. WebAuthn::register API call returns Error 422

{"message":"Attestation Error: Relying Party ID not scoped to current.","errors":{"attestation":["Attestation Error: Relying Party ID not scoped to current."]}}

Browser and system

Chrome on macOS

The documentations does not say anything about the U2F feature, so it should be either fixed (and "just work"), or removed.

[ildyria]

If I am not wrong this is because the APP_URL is not set properly in the .env.

That being said, there have been some changes recently in Laragear and it seems that webAuthn uses has been restricted to a certain type of devices. I need to investigate that.

[nicokaiser]

Oh you are right, the APP_URL was not set, thanks for clarifying.

[nicokaiser]

Would it make sense though to completely disable the WebAuthn feature if no APP_URL is set?

[ildyria]

Would it make sense though to completely disable the WebAuthn feature if no APP_URL is set?

Not necessarily, but to have that info in the diagnostics yes.

[ildyria]

Also to be added in https://lycheeorg.github.io/docs/faq_troubleshooting.html