microg/GmsCore · error · RequestHandlingException

NOT_SUPPORTED_ERR

NOT_SUPPORTED_ERR

Error message

Origin $origin not supported

What it means

Origin validation in FIDO RequestHandling.checkIsValid: the request's origin scheme/facets do not match any form the validator accepts (https with matching RP ID or android:apk-key-hash with matching package), so the request is rejected as NOT_ALLOWED_ERR for that origin.

Source

Thrown at play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt:194

            throw RequestHandlingException(NOT_ALLOWED_ERR, "RP ID $rpId is a public suffix")
        }
        if (
            originUri.host != rpId &&
            originUri.host?.endsWith(".$rpId") != true
        ) {
            throw RequestHandlingException(NOT_ALLOWED_ERR, "RP ID $rpId not allowed from origin $origin")
        }
        // FIXME: Standard suggests doing additional checks, but this is already sensible enough
    } else if ((origin.startsWith("android:apk-key-hash:") || origin.startsWith("android:apk-key-hash-sha256:")) && packageName != null) {
        allApplicableFacetIds.addAll(getAllFacetIdCandidates(context, packageName, origin))
        val sha256facetId = allApplicableFacetIds.firstOrNull { it.startsWith("android:apk-key-hash-sha256:") }
            ?: throw RequestHandlingException(NOT_ALLOWED_ERR, "RP ID $rpId not allowed from origin $origin")
        val fp = Base64.decode(sha256facetId.substring(28), HASH_BASE64_FLAGS).toHexString(":")
        if (!isAssetLinked(context, rpId, fp, packageName)) {
            throw RequestHandlingException(NOT_ALLOWED_ERR, "RP ID $rpId not allowed from origin $origin (expected fingerprint $fp)")
        }
    } else {
        throw RequestHandlingException(NOT_SUPPORTED_ERR, "Origin $origin not supported")
    }
    val appId = authenticationExtensions?.fidoAppIdExtension?.appId
    if (appId != null) {
        if (!appId.startsWith("https://")) {
            throw RequestHandlingException(NOT_ALLOWED_ERR, "AppId $appId must start with https://")
        }
        if (Uri.parse(appId).host.isNullOrEmpty()) {
            throw RequestHandlingException(NOT_ALLOWED_ERR, "AppId $appId must have a valid hostname")
        }
        if (!isAppIdAllowed(context, appId, allApplicableFacetIds, rpId)) {
            throw RequestHandlingException(NOT_ALLOWED_ERR, "AppId $appId not allowed from facets [${allApplicableFacetIds.joinToString()}]")
        }
    }
}

private const val HASH_BASE64_FLAGS = Base64.NO_PADDING + Base64.NO_WRAP + Base64.URL_SAFE

fun RequestOptions.getWebAuthnClientData(callingPackage: String, origin: String): ByteArray {

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Use an https origin whose host equals or is a subdomain of the RP ID
2. For native apps, supply a valid android:apk-key-hash origin matching the calling package
3. Align the RP ID with the actual origin before issuing the request

When it happens

Trigger: Thrown at play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt:194 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/1df55757992a44f8. Report an issue: GitHub.