Webauthn dynamic origins check

Currently only a fixed set of allowed origins can be supplied when configuring webauthn.

It would be ideal if this could be expanded to be dynamic. In our case webauthn is used on authorization server which has the tenant name in front of the subdomain - e.g. bob.test.com. So the origin includes the tenant name and must be in the list of allowed origins for webauthn.

The authorization server can get a list of known tenants on startup, however tenants can also be registered later on - in which there is no way to update the allowed origins for webauthn.

I am against a pattern matching solution (allowing * in the origin check) as can be tricky to prevent security issues, and not sure if this would go against the webauthn spec.

Would an optional bean that can be registered to purely get the allowed origins be viable?

The issue names no files or tests. Start by tracing WebAuthn configuration and the current allowed-origin validation, then assess an extension point for retrieving origins dynamically without wildcard matching. Done means newly registered tenant origins can be supplied safely at runtime, with coverage for origin validation and updates.