openid / openid/OpenID4VC-HAIP
Clarification on allowed `request_uri_method`
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Currently HAIP dictates the following during presentation of VCs:
Signed Authorization Requests MUST be used by utilizing JWT-Secured Authorization Request (JAR) RFC9101 with the
request_uriparameter.
Per RFC9101 the only supported HTTP Method is GET.
OpenId4VP though, has introduced support for HTTP Method POST via request_uri_method, as well.
Judging from this comment, it appears that when using HAIP, only request_uri_method get must be used.
Could you please clarify/verify the above?
Would it also be possible to add a clarification to the profile and make explicit the requirement for request_uri_method?
Kind regards
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the HAIP profile text covering signed authorization requests and compare its request_uri requirements with RFC9101 and the linked OpenID4VP section. Done means the allowed request_uri_method is clarified and the profile explicitly states the requirement.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100