decentralized-identity / decentralized-identity/cawg-identity-assertion
Security: Consider limiting the URLs that are considered valid
Open
- Dominant language
- JavaScript
- Stars
- 11
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
There is currently no stated restriction or guidance on the URIs used for `verifiedIdentities[?].uri` or `verifiedIdentities[?].provider.id` as specified in [§8.1.2.5, "Verified identities](https://cawg.io/identity/1.1/#vc-credentialsubject-verifiedIdentities), though we assume that those would be `https` URIs.
Consider restricting these URIs to `https` or a known-approved list of URI types.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.