Expose MDS download or statement cache

[maccuaa]

Describe the issue

I’m building a serverless app (AWS Lambda) using @simplewebauthn/server

To avoid cold-start latency and runtime network calls to the FIDO MDS, I'd like to pre-fetch the MDS data at build time and then bundle the statements into the Lambda. When the Lambda starts, I can then pass in the pre-fetched statements to the initialize method using the functionality that exists today via the statements parameter.

Currently there’s no public API to either:

• Trigger the MDS download to obtain the parsed statements using the downloadBlob; or
• Read the populated statementCache after calling MetadataService.initialize()

Code Samples + WebAuthn Options and Responses

Something along the lines of:

import { MetadataService } from "@simplewebauthn/server";

const statements = await MetadataService.downloadBlob();

// or

await MetadataService.initialize();
const statements = MetadataService.statements;

What do you think?

[james-d-elliott]

Might be worth considering exposing the tooling for parsing, then allowing the MetadataService to be dependency injected as an interface users can implement themselves. This way they can implement their own concrete type which falls back to the current concrete type.

[MasterKale]

Hello @maccuaa, thank you for your patience through the holidays. I'm ramping back up on issues here and I think what you're asking for is pretty reasonable. MetadataService can definitely be improved here.

Give me a bit to work on this and I'll see what I can come up with.

[MasterKale]

@maccuaa @liegeandlief I've created #745 that should unblock your use case. When I release the next version of the library with this, you'll be able to do the following. Let me know what you think.

Initial run:

await MetadataService.initialize();
const statements = MetadataService.getCachedStatements();
await writeStatementsToDisk(statements);

Subsequent Run:

const savedStatements = await readStatementsFromDisk();
await MetadataService.initialize({
  mdsServers: [],
  statements: savedStatements,
});

[liegeandlief]

That's perfect for my serverless use case, thank you :)

[liegeandlief]

@MasterKale one other thought is that it would also be really helpful if you could expose the next update date from the metadata blob

[MasterKale]

I kinda suspected that might be the case for some projects. I pictured myself similarly asking for that if I were to be in your shoes but figured it might not actually be a problem.

I guess what I can do is return the entire collection of cached metadata as-is, which will have all that info for you, wrapped around the metadata statement, to write logic with as needed.

[liegeandlief]

In the scenario you describe will the library still perform verification of the trust chain and revocation checking etc. prior to exposing the entire metadata collection as-is?

[james-d-elliott]

If interested how I handled this in go-webauthn was allowing saving the blob itself and exposing a method to parse and validate it again. This way while you lose flexibility in tampering with and viewing individual statements, you gain it in the method of saving the blob since you can elect to save it to disk, to db, etc. with accompanying domain specific metadata very easily.

It's also important to note that the blob service has an ETag/If-None-Match system (I believe this is undocumented) and returns a 304 if you set the If-None-Match header value to the serial number of the UAF Metadata TOC payload.

[MasterKale]

If interested how I handled this in go-webauthn was allowing saving the blob itself and exposing a method to parse and validate it again. This way while you lose flexibility in tampering with and viewing individual statements, you gain it in the method of saving the blob since you can elect to save it to disk, to db, etc. with accompanying domain specific metadata very easily.

@james-d-elliott Thanks for sharing how you approached this. This is making me wonder if I don't add a "metadataBlobs" array that's similar to the existing statements argument, but accepts entire JWTs of metadata. This way all the data integrity checks still happen, while allowing for the JWT to be downloaded out of band and read from disk instead.

// Step 1: Manually download blob JWT from https://mds3.fidoalliance.org

// Step 2
const savedBlob: string = await readMDSBlobFromDisk();
await MetadataService.initialize({
  mdsServers: [],
  mdsBlobs: [savedBlob],
});

Something like this maybe 🤔