Remove `client_id_scheme` = `redirect_uri`
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
As per discussion in #263 I believe we should remove this Client ID scheme because there is no way to get authoritative metadata for the client which isn't open to un-detectable manipulation by the requestor impersonating the client. Put another way, with the redirect_uri client ID scheme there is no way to sign the request, have pre-registered metadata about the client nor a trusted way to resolve the clients metadata from a URL, thus meaning any client metadata reported in the client metadata parameter is entirely self-attested metadata about the client set by the requestor.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the discussion in #263 first, then locate the client_id_scheme definition and every reference to the redirect_uri scheme in the OpenID4VP specification. Done means the scheme is removed consistently and the specification no longer presents it as supported.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100