Summary
Passkey registration fails on a self-hosted Windshift deployment when running behind a reverse proxy.
The browser reports a WebAuthn/FIDO registration failure:
FIDO registration error: DOMException: The operation either timed out or was not allowed.
The backend initially reports:
GenerationError("failed to generate passkey: InvalidRpid")
Environment
- Windshift running via Docker
- Deployment based on the official Docker setup
- Reverse proxy: Synology Reverse Proxy
- Public URL:
https://project.jmbillard.com
Docker configuration:
BASE_URL=https://project.jmbillard.com
USE_PROXY=true
Reverse Proxy Setup
Traffic flow:
Browser
|
| HTTPS
|
Synology Reverse Proxy
|
| HTTP
|
Windshift container :8080
The reverse proxy forwards:
X-Forwarded-Proto: https
X-Forwarded-Host: project.jmbillard.com
X-Forwarded-Port: 443
Steps to Reproduce
- Access Windshift through the public HTTPS domain.
- Go to Security settings.
- Start passkey registration.
- Complete the browser prompt.
Actual Behavior
Passkey creation fails.
The WebAuthn registration request succeeds:
POST /api/users/1/credentials/webauthn/register/start
200 OK
but the browser rejects the generated credential.
Browser console:
FIDO registration error:
DOMException: The operation either timed out or was not allowed.
Additional Information
The public origin is correct:
returns:
The issue persists even after explicitly configuring forwarded headers in the reverse proxy.
Expected Behavior
Windshift should generate a valid WebAuthn Relying Party ID based on the public domain:
and allow passkey registration when deployed behind a standard reverse proxy.
Possible Cause
The generated WebAuthn rp.id may not match the public origin, possibly because the backend is using the internal request host instead of the configured BASE_URL or forwarded headers.
This may affect self-hosted deployments behind:
- Synology Reverse Proxy
- Nginx
- Traefik
- Caddy
- other TLS termination proxies
Request
Please verify the WebAuthn RP ID generation logic and ensure that self-hosted installations behind reverse proxies can correctly register passkeys.
Thanks!
Summary
Passkey registration fails on a self-hosted Windshift deployment when running behind a reverse proxy.
The browser reports a WebAuthn/FIDO registration failure:
The backend initially reports:
Environment
Docker configuration:
Reverse Proxy Setup
Traffic flow:
The reverse proxy forwards:
Steps to Reproduce
Actual Behavior
Passkey creation fails.
The WebAuthn registration request succeeds:
but the browser rejects the generated credential.
Browser console:
Additional Information
The public origin is correct:
returns:
The issue persists even after explicitly configuring forwarded headers in the reverse proxy.
Expected Behavior
Windshift should generate a valid WebAuthn Relying Party ID based on the public domain:
and allow passkey registration when deployed behind a standard reverse proxy.
Possible Cause
The generated WebAuthn
rp.idmay not match the public origin, possibly because the backend is using the internal request host instead of the configuredBASE_URLor forwarded headers.This may affect self-hosted deployments behind:
Request
Please verify the WebAuthn RP ID generation logic and ensure that self-hosted installations behind reverse proxies can correctly register passkeys.
Thanks!