[PR #6828] Make available toggling webauthn allow_subdomains #3855

New issue

Open

opened 2026-03-03 10:38:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 10:38:08 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6828
Author: @Bert-Proesmans
Created: 2/14/2026
Status: 🔄 Open

Base: main ← Head: webauth_origin_proper

📝 Commits (1)

19dc021 Add option to validate keys where browser reports subdomain of domain URL

📊 Changes

2 files changed (+10 additions, -2 deletions)

View changed files

📝 src/api/core/two_factor/webauthn.rs (+7 -2)
📝 src/config.rs (+3 -0)

📄 Description

This patch makes it possible to have DNS records for subdomains of DOMAIN_URL to point to vaultwarden instances with working webauthn keys.

I verified this code works by running patched vaultwarden instances. This change is foolproof, allow_subdomains might as well have been set to true by default but opted for defensive approach.

Before;

DOMAIN_URL = passwords.my.domain

RESET
Navigate to URL passwords.my.domain and login
Generate webauthn key and save
Attempt login and webauthn validation = OK
Navigate to URL <anything>.passwords.my.domain and login
Attempt webauthn validation => FAILURE

Before;

DOMAIN_URL = passwords.my.domain

RESET
Navigate to URL <anything>.passwords.my.domain and login
Generate webauthn key and save => FAILURE

=> webauthn_rs fails on the browser URL passed into auth_requests when doing stuff from hostname zone.passwords.my.domain

After;

DOMAIN_URL = passwords.my.domain
WEBAUTHN_ALLOW_SUBDOMAINS = true

Generating webauthn keys from browser URL <anything>.passwords.my.domain works
Validating webauthn keys from browser URL <anything>.passwords.my.domain works

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6828 **Author:** [@Bert-Proesmans](https://github.com/Bert-Proesmans) **Created:** 2/14/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `webauth_origin_proper` --- ### 📝 Commits (1) - [`19dc021`](https://github.com/dani-garcia/vaultwarden/commit/19dc021246e1ff731a3105907f2a41463eebdb5e) Add option to validate keys where browser reports subdomain of domain URL ### 📊 Changes **2 files changed** (+10 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/api/core/two_factor/webauthn.rs` (+7 -2) 📝 `src/config.rs` (+3 -0) </details> ### 📄 Description This patch makes it possible to have DNS records for subdomains of DOMAIN_URL to point to vaultwarden instances with working webauthn keys. I verified this code works by running patched vaultwarden instances. This change is foolproof, allow_subdomains might as well have been set to true by default but opted for defensive approach. Related discussion; https://github.com/dani-garcia/vaultwarden/discussions/6567 Before; DOMAIN_URL = passwords.my.domain 1. RESET 1. Navigate to URL passwords.my.domain and login 2. Generate webauthn key and save 3. Attempt login and webauthn validation = OK 4. Navigate to URL \<anything>.passwords.my.domain and login 5. Attempt webauthn validation => FAILURE Before; DOMAIN_URL = passwords.my.domain 1. RESET 1. Navigate to URL \<anything>.passwords.my.domain and login 2. Generate webauthn key and save => FAILURE => webauthn_rs fails on the browser URL passed into auth_requests when doing stuff from hostname zone.passwords.my.domain # After; DOMAIN_URL = passwords.my.domain WEBAUTHN_ALLOW_SUBDOMAINS = true * Generating webauthn keys from browser URL \<anything>.passwords.my.domain works * Validating webauthn keys from browser URL \<anything>.passwords.my.domain works --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>