Skip to content

Fix inconsistencies in the signed Request Object example (Section 5.4) - #809

Open
shlee1223 wants to merge 1 commit into
openid:mainfrom
shlee1223:main
Open

shlee1223 wants to merge 1 commit into
openid:mainfrom
shlee1223:main

Conversation

@shlee1223

Copy link
Copy Markdown

Thank you to the editors and the WG for all the work on OpenID4VP. As an implementer, I really appreciate how the spec has evolved, and I hope this small fix helps.

The example of a Request Object passed by value in Section 5.4 has three issues:

  1. It is described as signed (RS256), but uses the redirect_uri Client Identifier Prefix. Section 5.9.3 states that requests using this prefix cannot be signed. This PR switches the example to x509_san_dns:client.example.org, which allows signed requests and matches the FQDN of the redirect_uri. The client_id in the request URL, client_id, and iss in the payload are updated together, so they remain identical as required.
  2. The redirect_uri value contains a typo (https// instead of https://).
  3. The payload is missing response_mode, which is REQUIRED per Section 5.2. Added fragment, the default for vp_token.

Editorial change to a non-normative example only. No normative text is changed.

I have signed the OpenID Foundation Contribution Agreement (DCP WG) as [Suhyeon Lee / nine01223@naver.com].

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant