Package io.jans.fido2.service.readiness

Class WellKnownFetcher

java.lang.Object
io.jans.fido2.service.readiness.WellKnownFetcher
public class WellKnownFetcher extends Object
Fetches the two native-app association files from a relying party's domain, and nothing else.

This is the SSRF boundary of the readiness checker. What it guarantees:

  • The URL is built here, from a ValidatedRpId: exactly https://<rp-id>/.well-known/assetlinks.json or https://<rp-id>/.well-known/apple-app-site-association, port 443. No caller supplies a scheme, host, port, path or query.
  • The host name is resolved once. If any returned address is blocked by BlockedAddressClassifier, nothing is connected. Otherwise the connection is made to those exact addresses with no second lookup, so DNS cannot change its answer between the check and the connect. TLS still uses the original host name for SNI and certificate verification.
  • Redirects are never followed; a 3xx response is returned as data.
  • The body is read up to a fixed cap and no further. Compression is off, so the cap applies to the bytes on the wire.
  • Connect time, read time and total time are bounded.
  • No cookies, credentials or server tokens are sent, and no proxy is used. Only Accept and User-Agent (plus the Host header) are set.
  • Failures come back as a coarse WellKnownFetchResult.Failure, never as exception text.
Not covered: the DNS lookup itself is bounded by the JVM resolver, not by the timeouts here.

  • Field Details

  • Constructor Details

    • WellKnownFetcher

      public WellKnownFetcher()

    • WellKnownFetcher

      public WellKnownFetcher(int maxResponseBytes, int connectTimeoutMs, int readTimeoutMs, int totalTimeoutMs)

  • Method Details