Repository navigation
[ABCA] Resolving attester keys polishing #54683
Description
Description
This is a follow-up to #52766 . According to this comment from @dominikschlosser :
One gap I found while testing: when a client trusts a provider with X.509 trust anchors, an attestation without x5c still falls back to kid. If another configured provider has a JWKS with that kid, the X.509 policy is bypassed. It would be safer to call validateX509Chain for every attestation, also without x5c. It throws when X.509 trust is configured and no chain is sent, and returns null when no provider uses X.509 trust, so the kid fallback still works for JWKS-only setups. Happy to send that as a follow-up if you'd rather keep this PR as is.
Activity