openid / openid/OpenID4VCI

DPoP-Nonce is not clear enough to link its usage

Open
#656 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
125
Forks
41
PR merge metrics
No merged PRs in 30d

Description

In current specs, at nonce endpoint example shows about returning additional response header "DPoP-Nonce" which is not clear enough.

I read issue https://github.com/openid/OpenID4VCI/issues/412 and got the understanding it is to save additional call at credential endpoint, however its value in example is in the format of JWT.

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
DPoP-Nonce: eyJ7S_zG.eyJH0-Z.HX4w-7v

{
"c_nonce": "wKI4LT17ac15ES9bw8ac4"
}

According to DPoP usage, server returns an access token bound to passed public key in jwt format, however here in nonce endpoint there is no public key passed as it is an unprotected resource.

My questions:
What is the content of this response header jwt?
Is it really a jwt or can be any string similar to c_nonce?
If it is really jwt, what additional information need to be passed by wallet to link two different response nonces?

Also, could you please add some example at credential endpoint to depict usage of this response header.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the nonce endpoint example in this issue and compare it with the DPoP usage discussed in OpenID4VCI issue 412. Clarify the DPoP-Nonce response header format, how its value relates to c_nonce, and add a credential endpoint example showing how the header is used.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.