fix: passkey 文案 - #1936
Conversation
WalkthroughAdds backend defaulting in GetPasskeySettings to set Origins to ServerAddress when empty or "[]", following existing RPID init. Updates frontend descriptions for passkey.rp_id and passkey.origins to clarify defaults and formatting requirements. No API signature or validation logic changes. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant C as Caller
participant S as GetPasskeySettings (server)
Note over S: Initialize settings
C->>S: Request passkey settings
activate S
S->>S: Initialize/confirm RPID
alt Origins empty or "[]"
S->>S: Set Origins = ServerAddress
Note right of S: New defaulting step
else
S->>S: Keep provided Origins
end
S-->>C: Return settings (RPID, Origins, ...)
deactivate S
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🧪 Early access (Sonnet 4.5): enabledWe are currently testing the Sonnet 4.5 model, which is expected to improve code review quality. However, this model may lead to increased noise levels in the review comments. Please disable the early access features if the noise level causes any inconvenience. Note:
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
web/src/components/settings/SystemSetting.jsx (1)
1114-1114: Verify passkey.origins default behavior and add input validation
- Empty “Allowed Origins” now fall back to the server address instead of allowing any origin—confirm this change is intentional, that existing deployments have a migration path, and that release notes or a migration guide are in place.
- No matching backend code or documentation was found—ensure server behavior and user-facing docs are updated to reflect this.
- Recommend updating
submitPasskeySettings()to validate the origins input (e.g. reject or warn on[/]or other invalid formats) before submission.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
setting/system_setting/passkey.go(1 hunks)web/src/components/settings/SystemSetting.jsx(2 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
setting/system_setting/passkey.go (1)
setting/system_setting/system_setting_old.go (1)
ServerAddress(3-3)
🔇 Additional comments (1)
web/src/components/settings/SystemSetting.jsx (1)
1053-1053: Updated guidance correctly reflects RPID requirements.The text now clearly states that empty values default to the server address and emphasizes that the RP ID cannot include protocol prefixes (http:// or https://), which aligns with WebAuthn specifications where the RP ID must be a domain name only.
| if defaultPasskeySettings.Origins == "" || defaultPasskeySettings.Origins == "[]" { | ||
| defaultPasskeySettings.Origins = ServerAddress | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
LGTM! Origins defaulting logic aligns with frontend guidance.
The logic correctly defaults Origins to ServerAddress when empty or when set to the literal string "[]". This matches the updated frontend text stating "为空则默认使用服务器地址" (defaults to server address when empty).
Verify that ServerAddress is properly validated elsewhere to ensure it contains the protocol (https://) as required by the WebAuthn spec and indicated in the UI text. Run this script to check how ServerAddress is initialized and validated:
🏁 Script executed:
#!/bin/bash
# Description: Verify ServerAddress initialization and validation
# Search for ServerAddress assignment and validation
rg -nP -C3 'ServerAddress\s*=' --type=go
# Search for any validation of ServerAddress format
rg -nP -C3 '(http://|https://).*ServerAddress|ServerAddress.*(http://|https://)' --type=goLength of output: 2869
Enforce HTTPS scheme for ServerAddress
Add validation when setting ServerAddress (e.g., in model/option.go at the “ServerAddress” case) or before deriving the RPID (passkey.go:35-40) to reject or normalize any value that doesn’t start with “https://”, ensuring origins always comply with WebAuthn’s HTTPS requirement.
🤖 Prompt for AI Agents
In setting/system_setting/passkey.go around lines 45 to 47 (and the
ServerAddress handling in model/option.go at the “ServerAddress” case), enforce
that ServerAddress uses the HTTPS scheme by validating the value before using it
to derive origins/RPID: if the value does not start with "https://" either
reject it (return an error) or normalize it by prepending "https://" after
ensuring it is a valid URL; perform the check where ServerAddress is set
(model/option.go) or immediately before deriving RPID in passkey.go (lines
~35-40) so origins are always HTTPS-compliant, and surface an explicit
validation error if the scheme is not HTTPS rather than silently accepting or
using non-HTTPS values.
fix: passkey 文案
2 participants
Summary by CodeRabbit