"Error validating origin" when registering a Passkey (WebAuthn)

[eugenevetrov]

What happened?

Claworc is deployed behind a reverse proxy with additional authentication (Pangolin). Everything works correctly except for WebAuthn (Passkeys). When attempting to add a Passkey, the following error occurs: "Registration failed: Error validating origin."

The environment variables are set correctly and the domain is valid.

docker exec claworc-dashboard env | grep CLAWORC
CLAWORC_DATA_PATH=/app/data
CLAWORC_RP_ORIGIN=https://claworc.MY_DOMAIN.com
CLAWORC_RP_ID=claworc.MY_DOMAIN.com

The reverse proxy is configured to forward headers

host: claworc.MY_DOMAIN.com
x-forwarded-proto: https
x-forwarded-host: claworc.MY_DOMAIN.com

Origin is correct

However, based on the logs - WebAuthn\Claworc does not appear to pick up the correct HTTPS protocol from the headers — the logs show a URL with HTTP instead of HTTPS.

Steps to reproduce

Try to create Passkey when Claworc is reverse-proxied

Expected behavior

Passkey is registered successfully, and the correct protocol is picked up from the X-Forwarded-Proto header

Area

Auth (login, sessions, passkeys, RBAC)

Platform

Docker / Docker Compose

Relevant logs or screenshots

"POST http://claworc.MY_DOMAIN.com/api/v1/auth/webauthn/register/finish..."
       ^^^^

2026/04/15 11:45:48 "GET http://claworc-dashboard:8000/health HTTP/1.1" from 172.18.0.3:46714 - 200 157B in 44.898µs
2026/04/15 11:45:49 "GET http://claworc.MY_DOMAIN.com/health HTTP/1.1" from 172.18.0.3:54234 - 200 157B in 32.349µs
2026/04/15 11:45:52 "POST http://claworc.MY_DOMAIN.com/api/v1/auth/webauthn/register/finish?name=HP HTTP/1.1" from 172.18.0.3:54234 - 400 58B in 513.066µs
2026/04/15 11:45:53 "GET http://claworc-dashboard:8000/health HTTP/1.1" from 172.18.0.3:48880 - 200 157B in 52.55µs
2026/04/15 11:45:54 "GET http://claworc.MY_DOMAIN.com/api/v1/llm/catalog HTTP/1.1" from 172.18.0.3:54234 - 403 35B in 208.535µs

Version or commit

latest

[gluk-w]

Try CLAWORC_RP_ORIGINS - it accepts a comma-separated list

[eugenevetrov]

Try CLAWORC_RP_ORIGINS - it accepts a comma-separated list

Hello

This helped create a passkey.
But when I try to login using the passkey, an error "Passkey authentication failed" occurs. There are no errors visible in the logs - only 401

2026/05/26 20:17:21 "GET http://claworc.DOMAIN.com/api/v1/auth/me HTTP/1.1" from 172.19.0.3:42634 - 401 37B in 22.223µs
2026/05/26 20:17:22 "POST http://claworc.DOMAIN.com/api/v1/auth/webauthn/login/begin HTTP/1.1" from 172.19.0.3:42634 - 200 156B in 40.19µs
2026/05/26 20:17:23 "GET http://claworc-dashboard:8000/health HTTP/1.1" from 172.19.0.3:52670 - 200 345B in 68.924µs

[gluk-w]

I enhanced the error message. Could you update the image claworc/claworc and provide the exact error it displays

[eugenevetrov]

Hello!

Built May 28, 2026 - I don't see any new log entries

[gluk-w]

Do you still see "Passkey authentication failed"?

[eugenevetrov]

@gluk-w yes