search

openwallet-foundation / acapy

ACA-Py is a foundation for building decentralized identity applications and services running in non-mobile environments.
https://aca-py.org
Apache License 2.0
421 stars 515 forks source link

Feature request: make JSON-LD context validation optional #1787

Open pstuermlinger opened 2 years ago

pstuermlinger commented 2 years ago

Hi there,

I was experimenting with JSON-LD credentials the last days and when I demoed the results to my team, the demo stopped working. Just a couple of minutes later it worked again.

What happend? Using two 0.7.4-rc2 ACA-Pys I setup a script which issues a BBS+ credential from A to B. One of the contexts was a URL to an obviously quite unstable server. So when I first started the script, A was not able to retrieve the context from the server because it was down. Later, A was able to retrieve the context after 1 minute or so, but B needed a lot of time (retries?) as the server was very unstable/busy. While B was trying to fetch the context, its Swagger UI could not be loaded. It seems like the whole process was blocked.

For development/demo purposes I would like to have an option to disable context validation for either issueing or retrieving of a JSON-LD credential.

Second, loading of the context should not block aca-py at all.

Best regards Patrick

swcurran commented 2 years ago

I suspect the better answer to this is #1733.

My understanding of JSON-LD best practices is to NEVER dynamically load context, so one answer is to make sure that any context that will be needed is collected at build time. Perhaps it could be done in startup, with an explicit list of contexts collected? I don't think not doing context validation at all is good approach -- or even offering that as an option.

BTW -- I'm not sure how one builds an general purpose wallet (holder) with JSON-LD credentials if you have to know about all contexts at build time. I can see how an issuer and a verifier could be implemented, but a holder seems particularly interesting.

I think we should continue to build on #1733 -- perhaps with a better title? -- and not keep this open.

Let me know what you think.

pstuermlinger commented 2 years ago

I think #1733 is a step in the right direction and will help to mitigate this issue in production. However, if we are talking about development, testing, demos etc. where you might be dealing with a fresh aca-py startup, neither caching nor collecting on startup would solve the issue.

I agree that not doing context validation at all in production is a bad idea. Maybe, in order to prevent confusion about this decision, the startup arguments could reflect this in their names, e.g. --insecure-jsonld-issuance and --insecure-jsonld-reception.