[GH-ISSUE #980] RP_ID can't be changed after initial deployment? #686

New issue

Closed

opened 2026-02-25 23:43:16 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 23:43:16 +03:00

Owner

Originally created by @pro-sumer on GitHub (Mar 26, 2024).
Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/980

Until today I was using this configuration and 2FA via security keys worked fine:

ALLOWED_HOSTS=sub.domain.tld
SITE_ROOT=https://sub.domain.tld
RP_ID=sub.domain.tld

When I tried to move to a different subdomain (but keeping the old one for pings) adding 2FA via security keys no longer works (I removed all keys before the move):

ALLOWED_HOSTS=another_sub.domain.tld,sub.domain.tld
SITE_ROOT=https://another_sub.domain.tld
RP_ID=another_sub.domain.tld

Without 2FA I can log in on both another_sub.domain.tld and sub.domain.tld. However, when I try to add security keys on another_sub.domain.tld I get the error message "SecurityError: The provided RP ID is not a registrable domain suffix of the effective domain of the document.". Additionally, security keys can still be added on sub.domain.tld.

I did restart the Docker container. Why is it still using the old RP_ID value?

PS: I can't currently test any further due to this additional error: "Too Many Requests. Please try again later."

Originally created by @pro-sumer on GitHub (Mar 26, 2024). Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/980 Until today I was using this configuration and 2FA via security keys worked fine: ``` ALLOWED_HOSTS=sub.domain.tld SITE_ROOT=https://sub.domain.tld RP_ID=sub.domain.tld ``` When I tried to move to a different subdomain (but keeping the old one for pings) adding 2FA via security keys no longer works (I removed all keys before the move): ``` ALLOWED_HOSTS=another_sub.domain.tld,sub.domain.tld SITE_ROOT=https://another_sub.domain.tld RP_ID=another_sub.domain.tld ``` Without 2FA I can log in on both `another_sub.domain.tld` and `sub.domain.tld`. However, when I try to add security keys on `another_sub.domain.tld` I get the error message "_SecurityError: The provided RP ID is not a registrable domain suffix of the effective domain of the document._". Additionally, security keys can still be added on `sub.domain.tld`. I did restart the Docker container. Why is it still using the old RP_ID value? PS: I can't currently test any further due to this additional error: "_Too Many Requests. Please try again later._"

kerem closed this issue

2026-02-25 23:43:16 +03:00

kerem commented

2026-02-25 23:43:17 +03:00

Author

Owner

@cuu508 commented on GitHub (Mar 27, 2024):

When you are on the "Add Security Key" page and are about to enter the new key's name, please view the page source and look for a line that looks like so:

<script id="options" type="application/json">{"publicKey": {"rp": {"name": "healthchecks", "id": "another_sub.domain.tld"}, [...]</script>

In the JSON string, publicKey.rp.id key, does it show "another_sub.domain.tld"?

And, just to make sure, is the page URL https://another_sub.domain.tld/accounts/two_factor/webauthn/?

@cuu508 commented on GitHub (Mar 27, 2024): When you are on the "Add Security Key" page and are about to enter the new key's name, please view the page source and look for a line that looks like so: ``` <script id="options" type="application/json">{"publicKey": {"rp": {"name": "healthchecks", "id": "another_sub.domain.tld"}, [...]</script> ``` In the JSON string, `publicKey.rp.id` key, does it show "another_sub.domain.tld"? And, just to make sure, is the page URL `https://another_sub.domain.tld/accounts/two_factor/webauthn/`?

kerem commented

2026-02-25 23:43:17 +03:00

Author

Owner

@pro-sumer commented on GitHub (Mar 27, 2024):

Today adding the keys worked just fine... (and all the values seem to be as expected).

Could it be a browser cache issue yesterday?

Anyway, feel free to close this issue.

@pro-sumer commented on GitHub (Mar 27, 2024): Today adding the keys worked just fine... (and all the values seem to be as expected). Could it be a browser cache issue yesterday? Anyway, feel free to close this issue.