Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

plasmic's avatar

Webauthn cross domain

I'm in the process of implementing webauthn on a multi-tenant application. The application has a primary (landlord) domain for admins to login to, and each tenant is assigned a sub-domain, however tenants may also use a custom domain to access the site as well. Users in the application can belong to multiple tenants, and they can login to each of those tenants on their respective domains or subdomains with one set of credentials.

My goal is to allow them to use webauthn credentials across multiple tenants in the same application as well. When I create the public key options for an assertion or attestation request, I'm setting the rpId to the application's primary domain. Doing this should allow the same key to be used on the primary domain and any tenant sub domains as well with no issues. From what I understand though, is these keys will not be able to be used on a different domain, however.

I understand that your browser/device scopes a key to a specific domain for security reasons, but I'm wondering if any one out there knows of any way to associate multiple domains with a key or something like that, so the application's users can use the same webauthn key on tenant sites that are using a custom domain?

0 likes
0 replies

Please or to participate in this conversation.