Fixes #1751 - Add error thrown if APP_URL does not match current url

[ildyria]

Fixes #1751

This aims to avoid some of the confusions "why is U2F not working?".

[codecov]

Codecov Report

Merging #1985 (c4c07df) into master (12bd6d4) will increase coverage by 1.86%.
The diff coverage is 71.42%.

Additional details and impacted files

[qwerty287]

What happens if setting APP_URL with a subpath? Is this allowed or would this be a wrong configuration?

[ildyria]

What happens if setting APP_URL with a subpath? Is this allowed or would this be a wrong configuration?

Good point, I adapted the code to throw a warning in such cases:
8320d16

[d7415]

I wonder whether it's worth adding validation for subpaths (or the host of APP_URLs containing them), but that can always be added later.

Untested, as usual.

[qwerty287]

Not sure if you understood my point, but my question actually was: What happens with both domain and subpath? I.e. APP_URL=https://example.com/xzy. Is this supported/allowed by laravel?

[d7415]

Is this supported/allowed by laravel?

At a glance, it looks like it is.

[ildyria]

https://www.w3.org/TR/webauthn-2/#rp-id

The RP ID of a public key credential determines its scope. I.e., it determines the set of origins on which the public key credential may be exercised, as follows:

• The RP ID must be equal to the origin's effective domain, or a registrable domain suffix of the origin's effective domain.
• The origin's scheme must be https.
• The origin's port is unrestricted.

For example, given a Relying Party whose origin is https://login.example.com:1337, then the following RP IDs are valid: login.example.com (default) and example.com, but not m.login.example.com and not com.