MasterKale / SimpleWebAuthn

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.
https://simplewebauthn.dev
MIT License
1.62k stars 137 forks source link

Fix edge compute issues with cbor-x dynamic functions #511

Closed Maronato closed 10 months ago

Maronato commented 10 months ago

While adding webauthn support to a Next.js app, I kept getting the following error during build:

../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/decode.js
Dynamic Code Evaluation (e. g. 'eval', 'new Function', 'WebAssembly.compile') not allowed in Edge Runtime 
Learn More: https://nextjs.org/docs/messages/edge-dynamic-code-evaluation

Import trace for requested module:
../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/decode.js
../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/encode.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/deps.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidKey.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/index.js

Turns out cbor-x declares some dynamic functions that are not compatible with Vercel's edge compute and Cloudflare workers (info).

Thankfully, fixing it is fairly straighforward. cbor-x exports a version of itself without these eval statements via cbor-x/index-no-eval

I tested the change locally by changing the cbor import line in my node_modules to be export * as cborx from 'cbor-x/index-no-eval'; and it fixed the issue.

The Deno import can continue pointing to the regular export since it supports eval.

PS: a few months ago I merge a PR here for something related - lack of support for streaming APIs in serverless environments. That has since changed, so importing from cbor-x/index instead of cbor-x/encode isn't an issue anymore.

MasterKale commented 10 months ago

@Maronato This fix is now live in @simplewebauthn/server@9.0.1