Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

Summary

When allowed_origins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored.

Details

CheckAllowedOrigins stores each configured allowed origin as:

parse_url($allowedOrigin)['host'] ?? $allowedOrigin

and later reduces the received clientDataJSON.origin the same way:

parse_url($C->origin)['host'] ?? $C->origin

If the reduced value matches, the method returns early. As a result, for the normal allowed_origins path, the later HTTPS check is not reached.

This differs from WebAuthn Level 2, which requires verifying that C.origin matches the RP's origin (scheme + host + port), separately from verifying that authData.rpIdHash matches the expected RP ID.

Affected code:

• CheckAllowedOrigins.php

Spec references:

• §7.1 Registering a New Credential
• §7.2 Verifying an Authentication Assertion
• CollectedClientData.origin

PoC

Configuration:

webauthn:
  allowed_origins:
    - https://login.example.com:8443
  allow_subdomains: false

Send a registration or authentication response whose clientDataJSON.origin is:

https://login.example.com:9443

Observed: the response is accepted, because both values are reduced to login.example.com.

Expected: the response should be rejected, because https://login.example.com:8443 and are different origins.