More specific error when validation of MDS blob.jwt fails

[pmeulen]

New Feature Request

Summary

Problem: When webauthn starts for the first time it needs to warm-up the MDS cache from blob.jwt. When this file is too old the signature validation fails. In that case an exception is thrown. It is not clear that signature validation failed, but not what signature.

Value: Makes finding issues related to MDS metadata validity easier

Proposed Solution

• Action:

  • Log messages (notice) when the MDS cache updated starts and when it finishes.
  • Add the location on disk of the file that failed in the exception message.

• Impact: Low: affects logging.

Developer Checklist

To be completed by the developer during implementation.

• Updated CHANGELOG and other documentation where needed

Testing and QA

Clear cache and test with missing, invalid etc MDS file.
The MDS blob.jwt file can be downloaded from https://mds3.fidoalliance.org/
An old blob.jwt can be found in stepup/webauthn/blob.jwt in the history of the Openconext-devconf repo