From fb15c8951b3ca9ae96c519112081bc210d843bd0 Mon Sep 17 00:00:00 2001 From: Jonathon Leight Date: Sun, 5 Jul 2026 14:36:31 -0400 Subject: [PATCH] Fix e2e tests in CI --- internal/e2e/harness_test.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/internal/e2e/harness_test.go b/internal/e2e/harness_test.go index 4c61d57..f994fd8 100644 --- a/internal/e2e/harness_test.go +++ b/internal/e2e/harness_test.go @@ -140,11 +140,13 @@ func newE2EServer(t *testing.T) *e2eServer { port := ln.Addr().(*net.TCPAddr).Port origin := func(h string) string { return fmt.Sprintf("https://%s:%d", h, port) } - // The RP ID is browserHost(): it's a registrable-domain suffix of every - // surface host (app./auth./root.), so it's a valid RP ID for a - // ceremony run from any of them, and every surface origin is allowed. + // The RP ID is the auth host. WebAuthn ceremonies only run there (signup), and + // its own host is a valid RP ID for that origin. Using the auth host (rather + // than the bare browserHost parent) also guarantees the RP ID contains a dot, + // which WebAuthn requires — browserHost() is a single label in CI (the step + // name, e.g. "e2e"), which would fail go-webauthn's domain validation. authSvc, err := auth.New(st, st.Pool(), auth.Config{ - RPID: browserHost(), RPDisplayName: "test", + RPID: authHost(), RPDisplayName: "test", RPOrigins: []string{origin(appHost()), origin(authHost()), origin(rootHost())}, AppHost: appHost(), AuthHost: authHost(), RootHost: rootHost(), Secure: true,