change origin verify to use fully qualified origin (#213)

see also duo-labs/webauthn#60

Co-authored-by: dgorbach <[email protected]>

Author: aseigler

Src/Fido2/AuthenticatorResponse.cs

@@ -68,7 +68,7 @@ protected void BaseVerify(string expectedOrigin, byte[] originalChallenge, byte[
                 throw new Fido2VerificationException("Challenge not equal to original challenge");
 
             // 5. Verify that the value of C.origin matches the Relying Party's origin.
-            if (Origin != expectedOrigin)
+            if (!string.Equals(FullyQualifiedOrigin(this.Origin), expectedOrigin, StringComparison.OrdinalIgnoreCase))
                 throw new Fido2VerificationException($"Origin {Origin} not equal to original origin {expectedOrigin}");
 
             // 6. Verify that the value of C.tokenBinding.status matches the state of Token Binding for the TLS connection over which the assertion was obtained. 
@@ -78,5 +78,12 @@ protected void BaseVerify(string expectedOrigin, byte[] originalChallenge, byte[
                 TokenBinding.Verify(requestTokenBindingId);
             }
         }
+
+        private string FullyQualifiedOrigin(string origin)
+        {
+            var uri = new Uri(origin);
+
+            return $"{uri.Scheme}://{uri.Host}";
+        }
     }
 }