request_uri_method is not clearly defined and has caused interoperability issues
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
request_uri_method does not seem to clearly state if it needs to be included in the request object or not.
Testing by the certification team has revealed some wallets fail if it is included in the request object. Hence the certification tests currently omit it, but we're unsure if we should reject verifiers that include it.
We need a clear position where there is a symmetry between what the tests include when testing a wallet and the checks we perform on a request object from the verifier, so that we catch the above interoperability problem correctly. We'd appreciate clarification from the WG on what the position should be.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the definition of request_uri_method and the certification tests that currently omit it. Compare the expected wallet request with verifier-side request-object checks; this is done when the WG documents whether inclusion is allowed and the tests and checks enforce the same position.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100