Webcrypto Polyfill package by jaredperreault-okta · Pull Request #23 · okta/okta-client-javascript

jaredperreault-okta · 2026-03-21T13:29:32Z

Initial Setup of @okta/react-native-platform
MVP Impl of @okta/react-native-webcrypto-bridge

…rectness, and architecture improvements Critical fixes: - Fix Android exportKey compilation error (undefined keyPair variable) - Fix Android importKey type mismatch (KeyPair vs KeyPairEntry) - Fix iOS silent failure in getRandomValues (now calls fatalError on CSPRNG failure) - Fix iOS importKey key size calculation (derive from modulus, not DER blob) - Fix iOS ASN.1 DER parsing with proper length decoding (replaces hardcoded offsets) - Fix iOS hardcoded exponent with parsed value from key data Security & safety: - Eliminate all force-unwrap (as!) casts in iOS via typed KeyEntry struct - Add synchronized blocks to all Android keyStore accesses for thread safety - Add key usage validation in JS verify() to match WebCrypto spec - JS getRandomValues validates returned length matches requested length Architecture: - Migrate bridge serialization from number[]/[NSNumber]/ReadableArray to Base64 strings across all layers (iOS, Android, TypeScript spec, JS polyfill), reducing serialization overhead from ~400% to ~33% - Extract iOS RSA DER parsing/construction into standalone RSAKeyUtils.swift for testability - Replace Android hand-rolled X.509 DER construction (~60 lines) with platform RSAPublicKeySpec - Remove dead code (getCryptoAlg), fix typos, clean up unused parameters Infrastructure: - Fix Jest config (testMatch pattern, setupFiles path, test import paths) - Add unit tests for digest, getRandomValues, importKey, verify, and polyfill installation - Update mocks to match Base64 bridge interface - Remove private:true flag, remove nonexistent ./cpp from files array - Update Android SDK defaults to 35

Harden native crypto bridge with security, correctness, and architecture improvements

FeiChen-okta

Left some comments for the android implementation.

FeiChen-okta · 2026-04-02T21:09:36Z

+
+    @ReactMethod(isBlockingSynchronousMethod = true)
+    fun randomUUID(): String {
+        return UUID.randomUUID().toString()


use SecureRandom. and 16 bytes

Android module is on the wrong path. Add biometric auth and fix the android implementation by using android keystore.

update the android components.

FeiChen-okta · 2026-04-17T21:07:53Z

+    companion object {
+        const val NAME = "WebCryptoBridge"
+
+        private val cryptoKeys = mutableMapOf<String, CryptoKey>()


Move out of companion object. Reloading this module will keep this since the companion object survives reloads.

Also do you need a remove method? to clean up keys that are not needed?

Removal is an excellent question. The WebCrypto API doesn't have a concept of removal. For now I think the keys clearing when the app closes is good enough. Standard usage shouldn't result in more than a few keys

FeiChen-okta · 2026-04-17T21:16:08Z

+        promise: Promise
+    ) {
+        runCatching {
+            if (algorithm != "SHA-256") {


can we just remove algorithm as a parameter if it only support SHA-256? Allowing anything else will just lead to error anyways.

This may support other algorithms in the future

FeiChen-okta · 2026-04-17T21:18:06Z

+
+dependencies {
+    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+    implementation 'com.facebook.react:react-native:+'


use a specific version to avoid supply chain risks.

I attempted to address this, not sure if it did so successfully

Configures automated testing for packages/react-native-webcrypto-bridge: - Android: JUnit/Robolectric tests via Gradle on Linux executor - iOS: Swift Package Manager tests on macOS executor - Both jobs run in parallel with intelligent caching Jobs restore dependencies from cache based on build.gradle/Package.swift checksums, reducing build times by 50-70% on subsequent runs. Test results and artifacts are stored for CircleCI reporting.

Change xcode from 'latest' to '16.1' to match CircleCI schema requirements. Xcode version must be a specific version string, not 'latest'.

Change macos.m1 to macos.medium for valid Xcode 16.1 compatibility. Remove unnecessary environment variables.

Change cimg/android:latest to cimg/android:2024.12 (a valid versioned image). CircleCI requires specific image versions, not 'latest' tags.

The circleci/macos orb doesn't provide executor definitions. Use simple custom executors with direct Docker and macOS config.

AlexNachbaur · 2026-04-20T17:47:57Z

Is this supposed to be committed? Or was this cache file added accidentally?

AlexNachbaur · 2026-04-20T17:48:14Z

Same goes for this and the other files in the .idea directory

AlexNachbaur · 2026-04-27T16:49:32Z

+    // Platform-specific redirect URI - iOS uses single slash, Android uses double slash
+    const redirectUri = Platform.OS === 'ios'
+      ? 'com.oktapreview.jperreault-test:/callback'
+      : 'com.oktapreview.jperreault-test://callback';


I don't think this is really platform specific, you can just change the OIDC config to match in the auth server configuration.

This is just test app code - I'll clean this up in a follow up PR

AlexNachbaur · 2026-04-27T16:50:30Z

-  // scopes: ['openid', 'email', 'profile', 'offline_access'],
-  scopes: ['offline_access'],
+  scopes: ['openid', 'email', 'profile', 'offline_access'],
+  // scopes: ['offline_access'],


Commented-out?

This is just test app code - I'll clean this up in a follow up PR

AlexNachbaur · 2026-04-27T18:38:06Z

+extension String {
+    public var base64URLDecoded: String { convertToBase64URLDecoded() }
+
+    private func convertToBase64URLDecoded() -> String {
+        var result = replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+
+        while result.count % 4 != 0 {
+            result.append(contentsOf: "=")
+        }
+
+        return result
+    }
+}
+
+extension Data {
+    public func base64URLEncodedString() -> String {
+        var base64 = self.base64EncodedString()
+        base64 = base64.replacingOccurrences(of: "+", with: "-")
+        base64 = base64.replacingOccurrences(of: "/", with: "_")
+        base64 = base64.replacingOccurrences(of: "=", with: "")
+        return base64
+    }
+}


Duplicate code, this is already present in another Swift file

AlexNachbaur · 2026-04-27T23:24:44Z

+  s.summary      = package["description"]
+  s.homepage     = "https://github.com/okta/okta-client-javascript"
+  s.license      = package["license"]
+  s.authors      = { "Okta" => "jared.perreault@okta.com" }


The author name / email should be changed to our standard one used for our other libraries, as opposed to our own Okta email.

AlexNachbaur · 2026-04-27T23:26:22Z

+  "types": "dist/types/index.d.ts",
+  "react-native": "src/index.ts",
+  "source": "src/index.ts",
+  "author": "jared.perreault@okta.com",


AlexNachbaur · 2026-04-29T18:55:35Z

The separate lock() / unlock() calls can be error prone if a developer messes something up in the future. NSLock conforms to the NSLocking protocol which provides a convenience withLock wrapper that ensures a block of code is run within a locked context.

We should try to use this instead, if possible.

jaredperreault-okta added 15 commits March 19, 2026 10:22

initial commit

716eafe

progress

43e995c

progress

43e8267

progress

302e2d4

progress

51df65b

progress

944accf

progress

d0d6649

progress

7987ca3

progress

79af38e

functional baseline

48c49ea

cleanup

474b9da

progress: WORKING

572e589

updates Android bridge with Base64 URL encoding updates

ddcc08b

first pass at @okta/react-native-platform

f4d9c4f

fix

5bbfbcb

jaredperreault-okta marked this pull request as ready for review March 26, 2026 20:25

FeiChen-okta reviewed Apr 1, 2026

View reviewed changes

Comment thread ...-native-webcrypto-bridge/android/main/java/com/okta/webcryptobridge/WebCryptoBridgeModule.kt Outdated

AlexNachbaur and others added 2 commits April 2, 2026 11:41

Merge pull request #25 from AlexNachbaur/an-rn-webcrypto

2fd97ee

Harden native crypto bridge with security, correctness, and architecture improvements

FeiChen-okta reviewed Apr 2, 2026

View reviewed changes

Comment thread ...-native-webcrypto-bridge/android/main/java/com/okta/webcryptobridge/WebCryptoBridgeModule.kt Outdated

FeiChen-okta reviewed Apr 2, 2026

View reviewed changes

FeiChen-okta and others added 5 commits April 10, 2026 19:48

update the android components.

fb56ffa

Android module is on the wrong path. Add biometric auth and fix the android implementation by using android keystore.

Merge pull request #29 from okta/fc-android-webcrypto-impl

4f619d3

update the android components.

kotlin first pass

c010dc9

android working build

ebd8b56

updates ios code

7eb295d

FeiChen-okta requested changes Apr 17, 2026

View reviewed changes

android feedback

c2b2fb5

FeiChen-okta approved these changes Apr 20, 2026

View reviewed changes

functioning Android unit tests

c35d929

jaredperreault-okta added 22 commits April 22, 2026 09:33

adds android unit/integ tests

5a3a370

added concurrency tests

61cd93d

adds ios unit/integ tests

1c74261

Fix CircleCI macOS executor Xcode version format

2c6011a

Change xcode from 'latest' to '16.1' to match CircleCI schema requirements. Xcode version must be a specific version string, not 'latest'.

Fix CircleCI macOS resource class configuration

e68679c

Change macos.m1 to macos.medium for valid Xcode 16.1 compatibility. Remove unnecessary environment variables.

Update Android Docker image to specific version

0662bc7

Change cimg/android:latest to cimg/android:2024.12 (a valid versioned image). CircleCI requires specific image versions, not 'latest' tags.

progress

2b6983b

progress

409d7b6

progress

cd339bd

progress

496cb92

Revert to custom executors; keep orbs for future use

49b378d

The circleci/macos orb doesn't provide executor definitions. Use simple custom executors with direct Docker and macOS config.

progress

abe0bb3

progress

6d6ea74

progress

8d49b7f

progress

43b0c04

progress

307a619

progress

6bd4cc1

adds jest tests

1b60869

linter fixes

322073d

ci fix

83706b9

publish fix

07e0d2c

AlexNachbaur reviewed Apr 29, 2026

View reviewed changes

feedback

5464599

jaredperreault-okta mentioned this pull request Apr 30, 2026

feat: TokenStorage #24

Open

AlexNachbaur approved these changes Apr 30, 2026

View reviewed changes

oktapp-aperture-okta Bot merged commit ed58f5d into jp-react-native-sdk Apr 30, 2026
4 checks passed

oktapp-aperture-okta Bot deleted the jp-rn-webcrypto branch April 30, 2026 17:23

Conversation

jaredperreault-okta commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FeiChen-okta left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jaredperreault-okta commented Mar 21, 2026 •

edited

Loading