From f9f4d59c6b57e05513c425a3d9764c9ba6034ed3 Mon Sep 17 00:00:00 2001 From: Leo Vasanko Date: Sat, 4 Oct 2025 17:26:03 -0600 Subject: [PATCH] Deny creating sessions for hosts other than rp-id subdomains. --- passkey/authsession.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/passkey/authsession.py b/passkey/authsession.py index d4cc66c..c505f4e 100644 --- a/passkey/authsession.py +++ b/passkey/authsession.py @@ -13,7 +13,7 @@ from uuid import UUID from .config import SESSION_LIFETIME from .db import ResetToken, Session -from .globals import db +from .globals import db, passkey from .util import hostutil from .util.tokens import create_token, reset_key, session_key @@ -48,6 +48,10 @@ async def create_session( normalized_host = hostutil.normalize_host(host) if not normalized_host: raise ValueError("Host required for session creation") + hostname = normalized_host.split(":")[0] # Domain names only, IPs aren't supported + rp_id = passkey.instance.rp_id + if not (hostname == rp_id or hostname.endswith(f".{rp_id}")): + raise ValueError(f"Host must be the same as or a subdomain of {rp_id}") token = create_token() now = datetime.now(timezone.utc) await db.instance.create_session(