Correctly scope relying party ID (rpId) and handle cross-subdomain passkey sharing

Steps

1. rpId must be a registrable domain suffix of the effective domain of the page origin; for a page at app.example.com you may set rpId to 'app.example.com' or 'example.com' but not 'other.com' or 'com'.
2. Choose rpId at the eTLD+1 level (e.g. 'example.com') if you want credentials to be usable across subdomains (app.example.com, auth.example.com); credentials registered with a narrower rpId cannot be used at a broader one.
3. The rpIdHash in authenticatorData is SHA-256(rpId); the server must compute SHA-256 of its expected rpId and compare byte-for-byte with the hash in authenticatorData during both registration and authentication verification.
4. For Related Origin Requests (allowing a credential registered on one origin to be used on a related origin), serve a /.well-known/webauthn JSON file listing the allowed origins from the authoritative origin domain.
5. When an application moves from a subdomain to a root domain (or vice versa), existing credentials registered under the old rpId cannot be migrated — users must re-enroll.