Running on localhost:3000 without https

[lcmen]

Hey!
What config.rp_id and config.origin values should I use to make this library work on http://localhost:3000?

I'm trying to pair webauthn-ruby with github/webauthn-json but I'm getting Error: 'origin' is not a valid https origin when I call create({ payload: options }).

Thank you in advance for any hints!

[santiagorodriguez96]

Hi @lcmen! 👋

It should work properly with http://localhost:3000 as the origin when using localhost without https – I'm able run our demo app that also uses WebAuthnJSON in my local machine without the need of setting https.

However, the 'origin' is not a valid https origin error is coming from the browser so maybe something's wrong with your browser 🤔

Could it be caused by HSTS? Have you developed another project using localhost with https? If you go to chrome://net-internals/#hsts and in the QUERY textbox you enter localhost, do you see a Not found message?

[lcmen]

Hey @santiagorodriguez96!
I appoligize for such delay in reply.

Could it be caused by HSTS? Have you developed another project using localhost with https? If you go to chrome://net-internals/#hsts and in the QUERY textbox you enter localhost, do you see a Not found message?

I don't have any HSTS records for localhost.

On the other hand, I don't know what happened but now everything works on HTTP. I was using localhost gem for a while to configure https for Puma locally, then I gave regular http another try today and it worked. I'm sorry I can't be more precisce.

PS. I was using a following config to test it:

WebAuthn.configure do |config|
  config.origin = ENV.fetch("WEB_AUTHN_ORIGIN", "http://localhost:3000")
  config.rp_id = ENV.fetch("WEB_AUTHN_RP_ID", "localhost")
  config.rp_name = "MyApp"
end