ClientData verification fails for AppID with subpath

[thmo]

This code

u2f/util.go

Lines 107 to 116 in d21a03e

	foundFacetID := false
	for _, facetID := range challenge.TrustedFacets {
	if facetID == cd.Origin {
	foundFacetID = true
	break
	}
	}
	if !foundFacetID {
	return errors.New("u2f: untrusted facet id")
	}

compares the facetID to be equal to the Origin, as reported by the client. However, the specs say:

If the caller's FacetID is an https:// Origin sharing the same host as the AppID, (e.g. if an application hosted at https://fido.example.com/myApp set an AppID of https://fido.example.com/myAppId), no additional processing is necessary and the operation may proceed.

The check should be modified to reflect that, i.e. accept an Origin shareing the same host as the AppID.

The issue came up here: go-gitea/gitea#10231