WebAuthn

Passkeys, relying party IDs, and the Related Origin Requests rules browsers actually enforce.

2 articles by Paul Scarrone.

• Passkey Origin Validator August 13, 2026A Go CLI that ports Chromium's Related Origin Requests check, counting eTLD+1 labels in a .well-known/webauthn file and answering whether a given caller origin would actually be authorised.
• Related Origin Requests - We Could All Use Some Validation August 13, 2026The W3C explainer for Related Origin Requests is a good start, and implementing from prose is still hard. The five item cap counts registrable-domain labels rather than domains, and the origins array turns out to be order sensitive, so the gap is worth closing with a check that runs.

All topics