Why Passkeys Registered on localhost Don't Work Through a Tunnel
A developer testing passkey login on localhost found that credentials disappeared once a tunnel was opened for a real phone. The cause is that passkeys are bound to a Relying Party ID, a domain name, so localhost and a tunnel hostname produce separate, non-shared credentials. The article explains the RP ID rules, including the suffix requirement, the ban on public suffixes, and the HTTPS secure-context requirement. It recommends a stable named tunnel subdomain so that the RP ID stays consistent across test sessions. The rules described carry over unchanged into WebAuthn Level 3, which was recently published as a W3C Recommendation.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.


Discussion (0)
Log in to join the discussion and vote.
Log in