Abort OCSP requests when the response times out

Open
#455 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
node.js, typescript
Domain
backend, security

Research direction

Start at SignedDataVerifier.checkOCSPStatus and trace the node-fetch request through response.buffer() and the network-error handler. Done means one 30-second deadline aborts the request and complete body read, closes the connection, returns RETRYABLE_VERIFICATION_FAILURE on timeout, and preserves existing classification for other body and OCSP errors.

Written by the indexing model from the issue text.

Description

Problem

An OCSP responder can send headers or part of the body, then stop responding. After 30 seconds, response.buffer() rejects, but the underlying request is not aborted and its socket can stay open.

SignedDataVerifier.checkOCSPStatus uses node-fetch's timeout: 30000. That option aborts a request waiting for headers, but does not abort the request when reading the body times out. The body read also sits outside the network-error handler, so the public verification methods return VERIFICATION_FAILURE instead of RETRYABLE_VERIFICATION_FAILURE.

This affects version 3.1.0 and main at bb0c0f874494321ea2d005329c3dc2188e893d41.

Expected behavior

Apply one 30-second deadline to the request and the complete response body. When it expires, abort the request, close the connection and return RETRYABLE_VERIFICATION_FAILURE.

Non-timeout response-body and OCSP validation errors should keep their current classification.

Related work

#345 introduced the OCSP timeout and retryable network-error status. #424 and #425 concern the App Store Server API client; they do not cover the OCSP request in SignedDataVerifier.

Dominant language
TypeScript
Stars
382
Forks
79
Avg merge
7h 53m
Merged PRs (30d)
8

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apple/app-store-server-library-node

All issues in apple/app-store-server-library-node

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.