Implement WebAuthn Related Origin Requests (ROR) to share passkeys across related domains

Steps

1. Related Origin Requests allow credentials registered under one origin (e.g. login.example.com) to be used from a related origin (e.g. app.example.com) without requiring both to share the same rpId.
2. The authoritative origin (the one whose domain is used as rpId) must serve a JSON file at /.well-known/webauthn listing the related origins that may act as a client for this rpId: { 'origins': ['https://app.example.com', 'https://mobile.example.com'] }.
3. When calling navigator.credentials.get or create from a related origin, the browser fetches the /.well-known/webauthn file from the rpId domain and checks if the caller's origin is listed; if yes, the ceremony proceeds with that rpId.
4. The relying party server still verifies the rpIdHash in authenticatorData against SHA-256(rpId); the rpId is the domain hosting /.well-known/webauthn, not the client origin.
5. Cache the well-known file with an appropriate Cache-Control header; browsers may cache it aggressively — ensure the cache TTL matches how frequently you update the origins list.