Move https requirement check further down as we accept http for localhost

libs/common/src/platform/services/fido2/domain-utils.ts

@@ -7,11 +7,6 @@ export function isValidRpId(rpId: string, origin: string) {
     return false;
   }
 
-  // The origin's scheme must be https.
-  if (!origin.startsWith("https://")) {
-    return false;
-  }
-
   const parsedOrigin = parse(origin, { allowPrivateDomains: true });
   const parsedRpId = parse(rpId, { allowPrivateDomains: true });
 
@@ -24,6 +19,11 @@ export function isValidRpId(rpId: string, origin: string) {
     return true;
   }
 
+  // The origin's scheme must be https.
+  if (!origin.startsWith("https://")) {
+    return false;
+  }
+
   // Reject IP addresses (both must be domain names)
   if (parsedRpId.isIp || parsedOrigin.isIp) {
     return false;