A relying party ID (rpId) is the expected domain that binds a WebAuthn credential and authentication ceremony to the intended service. The server verifies this value so a credential cannot be redirected to a malicious domain. section 15.3
Enforce the relying party ID alongside other authentication checks:
- Match the authentication data’s rpId against the service’s expected domain, such as example.com. section 15.3
- Reject mismatches because they can indicate phishing or a man-in-the-middle attempt. section 15.3
- Treat rpId checking as complementary to challenge validation and signature verification. section 15.3
Domain mismatch
If a WebAuthn ceremony expects example.com but authentication data reports another relying party ID, the server rejects the attempt rather than trusting the signature alone. section 15.3
