{"record":{"id":"1df55757992a44f8","repo":"microg/GmsCore","slug":"not-supported-err","errorCode":"NOT_SUPPORTED_ERR","errorMessage":"Origin $origin not supported","messagePattern":"Origin \\$origin not supported","errorType":"error_code","errorClass":"RequestHandlingException","httpStatus":null,"severity":"error","filePath":"play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt","lineNumber":194,"sourceCode":"            throw RequestHandlingException(NOT_ALLOWED_ERR, \"RP ID $rpId is a public suffix\")\n        }\n        if (\n            originUri.host != rpId &&\n            originUri.host?.endsWith(\".$rpId\") != true\n        ) {\n            throw RequestHandlingException(NOT_ALLOWED_ERR, \"RP ID $rpId not allowed from origin $origin\")\n        }\n        // FIXME: Standard suggests doing additional checks, but this is already sensible enough\n    } else if ((origin.startsWith(\"android:apk-key-hash:\") || origin.startsWith(\"android:apk-key-hash-sha256:\")) && packageName != null) {\n        allApplicableFacetIds.addAll(getAllFacetIdCandidates(context, packageName, origin))\n        val sha256facetId = allApplicableFacetIds.firstOrNull { it.startsWith(\"android:apk-key-hash-sha256:\") }\n            ?: throw RequestHandlingException(NOT_ALLOWED_ERR, \"RP ID $rpId not allowed from origin $origin\")\n        val fp = Base64.decode(sha256facetId.substring(28), HASH_BASE64_FLAGS).toHexString(\":\")\n        if (!isAssetLinked(context, rpId, fp, packageName)) {\n            throw RequestHandlingException(NOT_ALLOWED_ERR, \"RP ID $rpId not allowed from origin $origin (expected fingerprint $fp)\")\n        }\n    } else {\n        throw RequestHandlingException(NOT_SUPPORTED_ERR, \"Origin $origin not supported\")\n    }\n    val appId = authenticationExtensions?.fidoAppIdExtension?.appId\n    if (appId != null) {\n        if (!appId.startsWith(\"https://\")) {\n            throw RequestHandlingException(NOT_ALLOWED_ERR, \"AppId $appId must start with https://\")\n        }\n        if (Uri.parse(appId).host.isNullOrEmpty()) {\n            throw RequestHandlingException(NOT_ALLOWED_ERR, \"AppId $appId must have a valid hostname\")\n        }\n        if (!isAppIdAllowed(context, appId, allApplicableFacetIds, rpId)) {\n            throw RequestHandlingException(NOT_ALLOWED_ERR, \"AppId $appId not allowed from facets [${allApplicableFacetIds.joinToString()}]\")\n        }\n    }\n}\n\nprivate const val HASH_BASE64_FLAGS = Base64.NO_PADDING + Base64.NO_WRAP + Base64.URL_SAFE\n\nfun RequestOptions.getWebAuthnClientData(callingPackage: String, origin: String): ByteArray {","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/microg/GmsCore/blob/157c9d86ac46c195a86c2f15ab55c84036223f95/play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt#L176-L212","documentation":"Origin validation in FIDO RequestHandling.checkIsValid: the request's origin scheme/facets do not match any form the validator accepts (https with matching RP ID or android:apk-key-hash with matching package), so the request is rejected as NOT_ALLOWED_ERR for that origin.","triggerScenarios":"Thrown at play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt:194 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an https origin whose host equals or is a subdomain of the RP ID","For native apps, supply a valid android:apk-key-hash origin matching the calling package","Align the RP ID with the actual origin before issuing the request"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"157c9d86ac46c195a86c2f15ab55c84036223f95","analyzedAt":"2026-09-06T17:27:33.892Z","contentChangedAt":"2026-09-06T17:27:33.892Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}