WebAuthn.configuration.origin readable but not assignable

[jas14]

Hello! 👋

As of 3.4.0, this gem supports multiple allowed origins. 🎉

However:

• While WebAuthn.configuration.origin= is deprecated, WebAuthn.configuration.origin is not.
• WebAuthn.configuration.origin= no longer assigns to WebAuthn.configuration.origin.

Thus, calls to WebAuthn.configuration.origin are now broken (will always return nil).

I think this technically makes the switch to WebAuthn.allowed_origins= a "breaking change." This makes sense – WebAuthn.configuration.origin is nonsensical in the context of multiple allowed origins. But I think we need to communicate that to callers who may be using it.

Proposed solution

• Remove WebAuthn.configuration.origin (we can keep WebAuthn.configuration.origin= with the deprecation warning).
• Bump version to 4.0.0.

[santiagorodriguez96]

Hi @jas14! 👋

Thank you for the report and for taking the time to fix it 🙂 That's a good catch and we missed it – and you are right it causes a breaking change.

However we don't want to release v4 yet, so we might want to look for an alternative solution here. Ideally users should be able to continue using the WebAuthn.configuration.origin with a deprecation warning, to keep the gem backwards compatible for now.

Given that, I opened #484 with an alternative solution that I think it might do the trick. Let me know what you think about it.

[jas14]

Seems reasonable to me, certainly better than returning nil with no deprecation warning. Thanks!

I believe WebAuthn.configuration.origin will still be broken if you assign multiple allowed origins, but hopefully people address origin= and origin calls at once.

[santiagorodriguez96]

I believe WebAuthn.configuration.origin will still be broken if you assign multiple allowed origins, but hopefully people address origin= and origin calls at once.

That's true – however I think that throwing a deprecation warning when people use origin should be enough to help them remember that they should address this. We could see if it's worth returning another warning when origin will return nil because users have set multiple allowed origins 🤔

[santiagorodriguez96]

We've released v3.4.3 which should fix this 🚀