feat: server-side OCSP revocation checking - #25
Open
andyparsons wants to merge 4 commits into
Open
Conversation
When the C2PA SDK reports signingCredential.ocsp.inaccessible (OCSP unreachable from the browser due to mixed content or CORS), the client now automatically extracts the signing certificate chain from the file's JUMBF/COSE signature and forwards it to a Netlify Function proxy that queries the OCSP responder server-side. - ocspExtract.ts: client-side JUMBF walker + COSE CBOR unpacker that extracts the x5chain cert chain and OCSP responder URL from the file - netlify/functions/ocsp-proxy.ts: in-process-cached Netlify Function that builds an OCSP request DER, queries the responder, and parses the revocation status - Cache TTL configurable via OCSP_CACHE_TTL_SECONDS env var (1h prod, 5m deploy-preview); cache resets on function cold start - ReportViewer shows "Not revoked (server-side check)" / "Revoked" / "checking via server…" in place of the static inaccessible warning - Requires cborg for client-side CBOR decoding of COSE protected header Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add a dedicated "OCSP Revocation Checking" section explaining why browser-side OCSP checks fail (mixed content / CORS), how the client-side cert extraction and Netlify Function proxy work, the cache TTL configuration, and how to test locally with netlify dev. Also update: Features list, Project Structure, How It Works, Privacy & Security, and Dependencies. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Windows does not natively recognise HEIC/HEIF file types unless the optional HEIF Image Extensions codec pack is installed from the Microsoft Store. Without it, Chrome cannot identify the MIME type and sets file.type to '' for .heic/.heif drops. The extension fallback map previously had no entry for these extensions, so resolveMimeType returned '' and the C2PA SDK threw "Failed to read C2PA data: type is unsupported". Add heic, heif, avci, and avcs to EXTENSION_MIME_MAP so the extension is used as a reliable fallback when the browser cannot detect the type. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
✅ Deploy Preview for c2pa-conformulator ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Logs at each decision point: whether a check is needed, cert extraction outcome, responder URL, proxy request, and final result/error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
signingCredential.ocsp.inaccessible(OCSP responders are typically HTTP, blocked by browsers as mixed content from HTTPS pages), the tool now automatically performs a server-side revocation check via a Netlify Function proxyOCSP_CACHE_TTL_SECONDS: 1h production, 5m deploy preview)How the OCSP flow works
ocspExtract.tswalks the file's JUMBF boxes to find thec2pa.signaturebidb boxcborgand pulls the x5chain (key 33) from the protected header@peculiar/x509) to find the OCSP responder URL{ responderUrl, certDerB64, issuerDerB64 }to/.netlify/functions/ocsp-proxyHEIC/HEIF Windows fix
Windows Chrome cannot identify HEIC/HEIF MIME types unless the optional HEIF Image Extensions codec pack is installed from the Microsoft Store. Without it,
file.typearrives as'',resolveMimeTypehad no extension fallback for.heic/.heif, and the SDK received an empty format string. Addedheic,heif,avci, andavcstoEXTENSION_MIME_MAP. No install required on Windows after this fix; thumbnails still show a placeholder since the browser can't render HEIC pixel data without the codec.Test plan
http://— report should update from "checking via server…" to "Not revoked (server-side check)" once the proxy respondsocsp.inaccessiblestatus are unaffectednetlify dev) — should silently stay on "OCSP server inaccessible — checking via server…".heicfile on Windows Chrome — should process without error and show a placeholder thumbnail.heicbehaviour unchanged on Mac🤖 Generated with Claude Code