verifyRegistrationResponse() does not check crossOrigin/topOrigin #825

verifyAuthenticationResponse() checks crossOrigin and topOrigin against expectedTopOrigin (#759), but verifyRegistrationResponse() does not: a registration response with "crossOrigin": true, "topOrigin": "https://evil.test" in clientDataJSON verifies without error, and there is no expectedTopOrigin option to pass.

WebAuthn Level 3 asks the RP to check topOrigin in both ceremonies (§7.1 steps 10–11, §7.2 steps 13–14). Browsers allow cross-origin create() when the embedding page delegates publickey-credentials-create, so a site that lets other origins frame its pages could see a passkey registered from inside a third-party frame. The impact is low, because the credential still lands on the user's own account, but the two functions behaving differently is surprising.

Suggested behaviour: mirror the authentication check, i.e. accept an expectedTopOrigin option in verifyRegistrationResponse() and throw when crossOrigin is true and topOrigin is not expected.

Found with grimaldello, a differential test suite for WebAuthn RP libraries (case reg-cross-origin-true), against @simplewebauthn/server 14.1.0. The test vector is in vectors/cases.jsonl.