Describe the issue
Verifying attestation certificate chains eventually involves requesting CRLs from external websites to see if any certificates in the chain have been revoked. These URLs often point to non-RP websites, but the RP has no visibility into where exactly this passkey-related network traffic is going.
Right now @simplewebauthn/server uses globalThis.fetch to make network requests to URLs contained within the various certificates comprising a chain. What I want to add is a way for an RP to specify a "custom fetch" that takes a URL as an argument, and then lets the RP apply arbitrary policy to the URLs (is the URL on our allowlist, etc...), and to properties of the response that comes back (should be less than 500KB to prevent malicious payloads, etc...) before making the request and passing the response to SimpleWebAuthn.
Right now my thinking is to add something to SettingsService so I don't have to pipe a new argument through multiple levels of functions.
Describe the issue
Verifying attestation certificate chains eventually involves requesting CRLs from external websites to see if any certificates in the chain have been revoked. These URLs often point to non-RP websites, but the RP has no visibility into where exactly this passkey-related network traffic is going.
Right now @simplewebauthn/server uses
globalThis.fetchto make network requests to URLs contained within the various certificates comprising a chain. What I want to add is a way for an RP to specify a "customfetch" that takes a URL as an argument, and then lets the RP apply arbitrary policy to the URLs (is the URL on our allowlist, etc...), and to properties of the response that comes back (should be less than 500KB to prevent malicious payloads, etc...) before making the request and passing the response to SimpleWebAuthn.Right now my thinking is to add something to
SettingsServiceso I don't have to pipe a new argument through multiple levels of functions.