exp is not mandated in request objects
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
VP doesn't say anything about exp in request objects.
JAR also doesn't say anything, meaning we inherit the default behaviour from the JWT RFC, namely that exp is entirely optional (but wallets must respect it if it's there).
Maybe we want to say exp is required. Not sure if we want to say anything about iat / nbf too but they're in the same situation of being entirely optional for verifiers to use.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the request-object requirements in the OpenID4VP text, then compare the cited JAR and JWT RFC sections for exp, iat, and nbf behavior. Done means reaching a decision on which claims, if any, are required and updating the specification with clear verifier and wallet requirements.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100