Consolidate AppId for web-based and app-based U2F requests. (google#156)

rshlin · Apr 18, 2017 · ebad530 · ebad530
1 parent 100bc55
commit ebad530
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/u2f-gae-demo/src/com/google/u2f/gaedemo/servlets/BeginEnrollServlet.java b/u2f-gae-demo/src/com/google/u2f/gaedemo/servlets/BeginEnrollServlet.java
@@ -43,7 +43,8 @@ public void doPost(HttpServletRequest req, HttpServletResponse resp)
     boolean allowReregistration = Boolean.valueOf(req.getParameter("reregistration"));
     RegistrationRequest registrationRequest;
     U2fSignRequest signRequest;
-    String appId = (req.isSecure() ? "https://" : "http://") + req.getHeader("Host");
+    String appId =
+        (req.isSecure() ? "https://" : "http://") + req.getHeader("Host") + "/origins.json";
 
     try {
       registrationRequest = u2fServer.getRegistrationRequest(user.getEmail(), appId);

diff --git a/u2f-gae-demo/src/com/google/u2f/gaedemo/servlets/BeginSignServlet.java b/u2f-gae-demo/src/com/google/u2f/gaedemo/servlets/BeginSignServlet.java
@@ -39,7 +39,8 @@ public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOEx
     User user = userService.getCurrentUser();
 
     U2fSignRequest signRequest;
-    String appId = (req.isSecure() ? "https://" : "http://") + req.getHeader("Host");
+    String appId =
+        (req.isSecure() ? "https://" : "http://") + req.getHeader("Host") + "/origins.json";
     try {
       signRequest = u2fServer.getSignRequest(user.getEmail(), appId);
     } catch (U2FException e) {

diff --git a/u2f-gae-demo/war/origins.json b/u2f-gae-demo/war/origins.json
@@ -2,6 +2,10 @@
   "trustedFacets" : [{
     "version": { "major": 1, "minor" : 0 },
     "ids": [
+      "http://localhost:8888",
+      "https://u2fdemo.appspot.com",
+      "https://crxjs-dot-u2fdemo.appspot.com",
+      "https://noext-dot-u2fdemo.appspot.com",
       "android:apk-key-hash:bkHnlWEV_jRCPdYGJfwOl7Sn_CLC_2TE3h4TO1_n34I"
     ]
   }]