DPoP-Nonce is not clear enough to link its usage
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
In current specs, at nonce endpoint example shows about returning additional response header "DPoP-Nonce" which is not clear enough.
I read issue https://github.com/openid/OpenID4VCI/issues/412 and got the understanding it is to save additional call at credential endpoint, however its value in example is in the format of JWT.
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
DPoP-Nonce: eyJ7S_zG.eyJH0-Z.HX4w-7v
{
"c_nonce": "wKI4LT17ac15ES9bw8ac4"
}
According to DPoP usage, server returns an access token bound to passed public key in jwt format, however here in nonce endpoint there is no public key passed as it is an unprotected resource.
My questions:
What is the content of this response header jwt?
Is it really a jwt or can be any string similar to c_nonce?
If it is really jwt, what additional information need to be passed by wallet to link two different response nonces?
Also, could you please add some example at credential endpoint to depict usage of this response header.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the nonce endpoint example in this issue and compare it with the DPoP usage discussed in OpenID4VCI issue 412. Clarify the DPoP-Nonce response header format, how its value relates to c_nonce, and add a credential endpoint example showing how the header is used.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100