allow http://localhost origins

Yubico · Mar 28, 2024 · 336252a · 336252a
1 parent 7b87d82
commit 336252a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/fido2/rpid.py b/fido2/rpid.py
@@ -61,9 +61,10 @@ def verify_rp_id(rp_id: str, origin: str) -> bool:
         return False
 
     url = urlparse(origin)
-    if url.scheme != "https":
-        return False
     host = url.hostname
+    if url.scheme != "https":
+        if url.scheme != "http" or host != 'localhost':
+            return False
     if host == rp_id:
         return True
     if host and host.endswith("." + rp_id) and rp_id not in suffixes:

diff --git a/fido2/server.py b/fido2/server.py
@@ -450,9 +450,10 @@ def verify_app_id(app_id: str, origin: str) -> bool:
     :return: True if the App ID is usable by the origin, False if not.
     """
     url = urlparse(app_id)
-    if url.scheme != "https":
-        return False
     hostname = url.hostname
+    if url.scheme != "https":
+        if url.scheme != "http" or hostname != 'localhost':
+            return False
     if not hostname:
         return False
     return verify_rp_id(hostname, origin)