aud Claim Value in JWT Proof Sent to Credential Endpoint

This issue proposes defining a requirement for setting the value of the aud (audience) claim within the JWT proof sent to the credential endpoint. The proposal suggests that the aud claim should be set to the HTTP URL of the endpoint, rather than the entity ID of the credential issuer.

Rationale

The aud (audience) claim in JWT is intended to ensure that a JWT is intended for a specific recipient (or audience). Setting the aud claim to the HTTP URL of the credential endpoint, rather than the entity ID of the credential issuer, has several advantages:

1. Endpoint Specificity: Using the HTTP URL as the aud value ties the JWT proof directly to the specific endpoint that should accept it. This provides a clear and direct linkage between the JWT and its intended destination, enhancing security by preventing the JWT from being accepted by unintended endpoints and for different scopes.

2. Consistency with OAuth 2.0: In OAuth 2.0, the aud claim is often set to the URL of the resource server or the authorization server's token endpoint. Aligning the practice for credential issuance with OAuth 2.0 conventions can promote consistency across implementations and make the behavior more predictable for developers.

3. Flexibility for Credential Issuers: Credential issuers may host multiple endpoints for different purposes (e.g., issuing different types of credentials). Specifying the endpoint URL in the aud claim allows for finer-grained control and routing of JWT proofs to the appropriate processing logic.

4. Simplification of Validation Logic: By specifying the exact endpoint URL in the aud claim, the validation logic at the credential endpoint can be simplified. The endpoint can easily verify that it is the intended audience for the JWT without needing to map entity IDs to specific endpoint URLs.

Proposal

It is proposed that the specification or guidelines for sending JWT proofs to the credential endpoint include a requirement to set the aud claim to the HTTP URL of the endpoint. This approach should be documented as a best practice, with explanations provided for the rationale and benefits as outlined above.

Pull Request

This issue aims be resolved by the following PR: https://github.com/openid/OpenID4VCI/pull/188

Start by reading the issue proposal and the linked pull request #188 in the OpenID4VCI repository. Check how the specification currently describes JWT proofs and the aud claim, then confirm that the documented requirement uses the credential endpoint's HTTP URL and that the rationale is covered.