Make available toggling webauthn allow_subdomains #113

New Issue

MrUnknownDE · 2026-04-05T20:30:40+02:00

MrUnknownDE commented

2026-04-05 20:30:40 +02:00

Originally created by @Bert-Proesmans on 2/14/2026

This patch makes it possible to have DNS records for subdomains of DOMAIN_URL to point to vaultwarden instances with working webauthn keys.

I verified this code works by running patched vaultwarden instances. This change is foolproof, allow_subdomains might as well have been set to true by default but opted for defensive approach.

Related discussion; https://github.com/dani-garcia/vaultwarden/discussions/6567

Before;

DOMAIN_URL = passwords.my.domain

RESET
Navigate to URL passwords.my.domain and login
Generate webauthn key and save
Attempt login and webauthn validation = OK
Navigate to URL <anything>.passwords.my.domain and login
Attempt webauthn validation => FAILURE

Before;

DOMAIN_URL = passwords.my.domain

RESET
Navigate to URL <anything>.passwords.my.domain and login
Generate webauthn key and save => FAILURE

=> webauthn_rs fails on the browser URL passed into auth_requests when doing stuff from hostname zone.passwords.my.domain

After;

DOMAIN_URL = passwords.my.domain
WEBAUTHN_ALLOW_SUBDOMAINS = true

Generating webauthn keys from browser URL <anything>.passwords.my.domain works
Validating webauthn keys from browser URL <anything>.passwords.my.domain works

*Originally created by @Bert-Proesmans on 2/14/2026* This patch makes it possible to have DNS records for subdomains of DOMAIN_URL to point to vaultwarden instances with working webauthn keys. I verified this code works by running patched vaultwarden instances. This change is foolproof, allow_subdomains might as well have been set to true by default but opted for defensive approach. Related discussion; https://github.com/dani-garcia/vaultwarden/discussions/6567 Before; DOMAIN_URL = passwords.my.domain 1. RESET 1. Navigate to URL passwords.my.domain and login 2. Generate webauthn key and save 3. Attempt login and webauthn validation = OK 4. Navigate to URL \<anything>.passwords.my.domain and login 5. Attempt webauthn validation => FAILURE Before; DOMAIN_URL = passwords.my.domain 1. RESET 1. Navigate to URL \<anything>.passwords.my.domain and login 2. Generate webauthn key and save => FAILURE => webauthn_rs fails on the browser URL passed into auth_requests when doing stuff from hostname zone.passwords.my.domain # After; DOMAIN_URL = passwords.my.domain WEBAUTHN_ALLOW_SUBDOMAINS = true * Generating webauthn keys from browser URL \<anything>.passwords.my.domain works * Validating webauthn keys from browser URL \<anything>.passwords.my.domain works

MrUnknownDE closed this issue

2026-04-05 20:30:40 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#113