jose

Hi, @panva here. I've previously had Erwin effectively propose the existing code (not the one from the linked article, the one that's in the library today https://github.com/panva/jose/blob/v4.13.0/src/jwks/remote.t...) acknowledging that there is an even more unlikely edge case. Well, someone was bound to hit that second edge case. But please help me out on this, the code does not await the _pendingFetch promise and neither does it touch any runtime globals. So what gives? Please reach out on the cloudflare discord PanvA#6705.

> Technically, what ends up happening from the JS side is that the Promise that `fetch()` returned simply never resolves So, in a scenario like https://github.com/panva/jose/commit/e44cd18ea4cf8af173f874c..., I think that implies the isDone polling loop never completes, and all future requests hitting reload hang since _pendingFetch is already set? Context: https://github.com/panva/jose/issues/355#issuecomment-102795... The real cost of this is that I can't both 1) cache parsed state, just a Response that I need to re-parse every request, while 2) having singleflight characteristic where later requests in same worker wait for first one to do the work. (If you relax number 2 here, you can still use a global without Promises.) https://pkg.go.dev/golang.org/x/sync/singleflight

The second scenario, mentioned in https://github.com/panva/jose/issues/355#issuecomment-102795..., seems much harder to work around. If a canceled request leaves a Promise hanging, how will you notice? It's unclear to me how workerd handles canceled tasks. Javascript Promises themselves don't have a concept of canceling as such, maybe they reject the promises for canceled requests? Or maybe they just throw away the tasks, without giving them any notice -- after all, the whole point seems to be to mitigate harm from bugs causing runaway processing like infinite loops. Can someone confirm what actually happens? I'm having trouble triggering this in an observable way without writing a custom HTTP client. https://github.com/cloudflare/workerd/blob/5d644d0189246a22e... https://github.com/cloudflare/workerd/blob/5d644d0189246a22e... I also don

Related issue, not linked in the article but visible if you follow the source code link to main branch: https://github.com/panva/jose/issues/355

Sharpest edge I've encountered is the very much WIP WebCrypto API support. In practical terms, this means things like signing/verifying JWTs is not very well supported: https://github.com/panva/jose/discussions/243 That said, the situation is improving rapidly, and I've been personally willing to bet that the support will be solid by the time I finish prototyping and need to start adding auth to my latest project.