openid / openid/OpenID4VP

exp is not mandated in request objects

Open
#348 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

non-breaking
Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

VP doesn't say anything about exp in request objects.

JAR also doesn't say anything, meaning we inherit the default behaviour from the JWT RFC, namely that exp is entirely optional (but wallets must respect it if it's there).

Maybe we want to say exp is required. Not sure if we want to say anything about iat / nbf too but they're in the same situation of being entirely optional for verifiers to use.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the request-object requirements in the OpenID4VP text, then compare the cited JAR and JWT RFC sections for exp, iat, and nbf behavior. Done means reaching a decision on which claims, if any, are required and updating the specification with clear verifier and wallet requirements.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.