does anyone use response_type=code with OID4VP?
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
https://openid.net/specs/openid-4-verifiable-presentations-1_0-ID2.html#name-response says:
If the Response Type value is code (Authorization Code Grant Type), the VP Token is provided in the Token Response.
(and has a similar entry in the table)
Does anyone actually do this? If not we should probably remove it from the spec, it feels like it might be an unnecessary complication. I'm not sure it's actually fully defined either, e.g. there's no mechanism defined for a client using the x509_san_dns client_id_scheme to actually authenticate at the token endpoint.
(If people are actually using it then the conformance tests might need to support it, they don't currently.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked OID4VP specification's response section and review how response_type=code is described for the Authorization Code Grant Type. Check the conformance tests to see whether this flow is covered; done means deciding whether the option is used and should be retained, removed, or fully specified, including token-endpoint client authentication.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100