openid / openid/OpenID4VC-HAIP
Was HAIP meant to disallow pre-authorized code flow?
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 57
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
I'm sure there were discussions that the preauthorised code flow is not secure enough to be used with HAIP - however I can't find any text that disallows it.
The closest text is: https://openid.github.io/OpenID4VC-HAIP/openid4vc-high-assurance-interoperability-profile-1_0-wg-draft.html#section-4.2
But that just requires both parties to support offers that use authorization code flow, they can still choose to use the preauthorized code flow.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read section 4.2 of the linked OpenID4VC-HAIP draft first, then review the issue discussion for the rationale around pre-authorized code flow. Determine whether HAIP is intended to prohibit that flow, and make the specification wording unambiguous about the conclusion.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100