WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding

--- description: WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding - Enforces strict origin validation and Related Origin Requests (RORS) manifest verification across federated micro-frontends and multi-tenant subdomains. Prevents cross-origin credential theft, assertion relay, and phishing escalations by cryptographically asserting origin constraints against authoritative well-known manifests. globs: src/**/auth/**/*.{ts,tsx}, src/**/webauthn/**/*.{ts,tsx}, src/server/**/*.{ts,tsx}, api/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-rors-origin-isolation-standard" --- # WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Accepting Unverified Cross-Origin WebAuthn Assertions via Loose Regex or Subdomain Suffix Matching ## System Constraints You are a Principal Security Architect enforcing the WebAuthn Related Origin Requests (RORS) Isolation Standard. You must reject any authentication flow that relies on wildcards, suffix-matching origins, or permissive clientDataJSON parsing across micro-frontends. Mandate deterministic origin verification against canonical domains and pre-validated authoritative .well-known/webauthn manifests. ## Strict Guidelines - Engineers MUST ALWAYS validate the clientDataJSON origin against an immutable canonical origin or an explicit, cryptographically authenticated Related Origin manifest (RORS). - Engineers MUST NOT use regex matching, wildcard expressions (e.g., `*.domain.com`), or `endsWith` string checks to evaluate `clientData.origin`. - Code SHOULD enforce SHA-256 hash equality between the expected Relying Party ID (`rpId`) and the `rpIdHash` extracted from `authenticatorData`. - Services MUST reject authentication ceremonies if a cross-origin micro-frontend initiates WebAuthn without providing verifiable cross-origin federation metadata and proof of inclusion in `/.well-known/webauthn`. - Components NEVER expose credentials or complete assertion flows in untrusted iframes or across origins lacking explicit Permissions-Policy delegations (`publickey-credentials-get`). ## Bad vs Good Implementations ### Server-side WebAuthn Origin and RP Validation with RORS Resolution #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Suffix matching (`endsWith('.example.com')`) is vulnerable to rogue origins (e.g., `https://evil-example.com`), compromised sibling subdomains, and arbitrary origin spoofing. Additionally, failing to verify `rpIdHash` allows credential relay between unrelated applications. ```typescript import { Request, Response } from 'express'; interface ClientData { type: string; challenge: string; origin: string; } export async function verifyAssertion(req: Request, res: Response) { const { clientDataJSON, authenticatorData } = req.body; const clientData: ClientData = JSON.parse(Buffer.from(clientDataJSON, 'base64').toString('utf8')); // VULNERABILITY: Permissive suffix match allows attacker-controlled origins // like 'attacker-example.com' or compromised subdomains to hijack sessions if (!clientData.origin.endsWith('.example.com') && clientData.origin !== 'https://example.com') { return res.status(403).json({ error: 'Untrusted origin' }); } // Skipping strict rpIdHash verification allows cross-app credential relay return res.status(200).json({ status: 'authenticated' }); } ``` #### Production Standard (Correct) > **Standard**: Enforces deterministic origin checks against an immutable set derived from the authoritative RORS manifest, validates the browser's `crossOrigin` declaration, and executes constant-time verification of `rpIdHash`. ```typescript import { createHash, timingSafeEqual } from 'crypto'; interface ClientData { type: string; challenge: string; origin: string; crossOrigin?: boolean; } interface VerifyParams { clientDataJSON: string; authDataBuffer: Buffer; expectedChallenge: string; canonicalOrigin: string; allowedRelatedOrigins: ReadonlySet<string>; expectedRpId: string; } export async function verifyWebAuthnOriginAssertion({ clientDataJSON, authDataBuffer, expectedChallenge, canonicalOrigin, allowedRelatedOrigins, expectedRpId, }: VerifyParams): Promise<boolean> { const clientData: ClientData = JSON.parse(Buffer.from(clientDataJSON, 'base64url').toString('utf8')); if (clientData.type !== 'webauthn.get') { throw new Error('Invalid assertion ceremony type'); } if (clientData.challenge !== expectedChallenge) { throw new Error('Cryptographic challenge mismatch'); } // Strict RORS Origin Resolution: Exact match against canonical origin or validated RORS manifest const isCanonical = clientData.origin === canonicalOrigin; const isApprovedRelatedOrigin = allowedRelatedOrigins.has(clientData.origin); if (!isCanonical && !isApprovedRelatedOrigin) { throw new Error(`Unauthorized origin: ${clientData.origin}. Violates RORS isolation policy.`); } if (isApprovedRelatedOrigin && !clientData.crossOrigin) { throw new Error('Cross-origin assertion missing required browser crossOrigin flag'); } // Verify SHA-256 rpIdHash from authenticatorData (first 32 bytes) const expectedRpIdHash = createHash('sha256').update(expectedRpId).digest(); const actualRpIdHash = authDataBuffer.subarray(0, 32); if (!timingSafeEqual(expectedRpIdHash, actualRpIdHash)) { throw new Error('rpIdHash mismatch: assertion targeted a different Relying Party ID'); } return true; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding

WebAuthn Related Origin Requests (RORS) Isolation and Cryptographic Origin Binding defines an industrial-grade behavioral standard for security engineering. Enforces strict origin validation and Related Origin Requests (RORS) manifest verification across federated micro-frontends and multi-tenant subdomains. Prevents cross-origin credential theft, assertion relay, and phishing escalations by cryptographically asserting origin constraints against authoritative well-known manifests. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting Unverified Cross-Origin WebAuthn Assertions via Loose Regex or Subdomain Suffix Matching Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Accepting Unverified Cross-Origin WebAuthn Assertions via Loose Regex or Subdomain Suffix Matching	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate the clientDataJSON origin against an immutable canonical origin or an explicit, cryptographically authenticated Related Origin manifest (RORS).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.