From 7e5fd083800f4c029853dc8ca1f749342deaff31 Mon Sep 17 00:00:00 2001
From: Joe Carstairs <65492573+Sycamost@users.noreply.github.com>
Date: Sun, 24 Dec 2023 22:31:18 +0000
Subject: Sets expected origin correctly when verifying registration response
 (#56)

---
 api/auth/_verifyRegistrationResponse.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'api/auth/_verifyRegistrationResponse.ts')

diff --git a/api/auth/_verifyRegistrationResponse.ts b/api/auth/_verifyRegistrationResponse.ts
index 79b7736..99be2bb 100644
--- a/api/auth/_verifyRegistrationResponse.ts
+++ b/api/auth/_verifyRegistrationResponse.ts
@@ -6,6 +6,7 @@ import { verifyRegistrationResponse as innerVerifyRegistrationResponse } from '@
 import RELYING_PARTY from './_relyingParty';
 import addAuthenticator from '../db/_addAuthenticator';
 import addUser from '../db/_addUser';
+import env from '../_env';
 
 /**
  * Verifies the registration response returned by @simplewebauthn/browser's
@@ -24,7 +25,9 @@ export default async function verifyRegistrationResponse(
   const verification = await innerVerifyRegistrationResponse({
     response: registrationResponse,
     expectedChallenge,
-    expectedOrigin: origin,
+    expectedOrigin: env.ENVIRONMENT === 'dev'
+      ? 'https://scotsleidassocie.org'
+      : 'https://staging.scotsleidassocie.org',
     expectedRPID: RELYING_PARTY.id,
   }).catch((err) => {
     throw new Error('Registration response verification failed.', err);
-- 
cgit v1.2.3