Clarification to mandatory use of client_id
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
The client_id is said to be mandatory (section "5.2. Existing Parameters"), yet Appendix "A.2. Request" mentions it MUST be omitted in unsigned requests without giving any further information. This appears contradictory.
Section "5.9.3. Defined Client Identifier Prefixes" defines origin as an option for the client identifier prefix, yet the first bullet point in "A.5. Security Considerations" seems to hint at the client_id being removed.
This wording should be clearer to avoid confusion. One example would be to reference Appendix A directly in "5.9.3. Defined Client Identifier Prefixes" and define all DC API specifics there.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing sections 5.2, 5.9.3, A.2, and A.5 of the OpenID4VP specification, focusing on the stated requirements for client_id in signed and unsigned requests. Done means the mandatory-use wording, omission rule, origin prefix guidance, and Appendix A references no longer appear contradictory.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100