Contradicting use of response_uri parameter
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
Section 8.2 states that response_uri is REQUIRED when the Response Mode direct_post is used.
Section 5.9.3 contradicts this:
"redirect_uri: This prefix value indicates that the original Client Identifier part (without the prefix redirect_uri:) is the Verifier's Redirect URI (or Response URI when Response Mode direct_post is used). The Verifier MAY omit the redirect_uri Authorization Request parameter (or response_uri when Response Mode direct_post is used).
Suggest adjusting section 8.2 to reflect this exception.
Something along the lines of "REQUIRED when the Response Mode direct_post is used, unless combined with Client Identifier Prefix redirect_uri"
Alternatively given that B.2.6.1 states "The fourth element MUST be either the redirect_uri or response_uri request parameter, depending on which is present, as determined by the Response Mode."
and
"Unless otherwise stated, the values of client_id, nonce, redirect_uri, and response_uri request parameters referenced above MUST be obtained from the Authorization Request query parameters if the request is unsigned, or from the signed Request Object if the request is signed.",
removing the "MAY omit" sentence in section 5.9.3 might be a more appropriate remedy.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare Sections 8.2, 5.9.3, and B.2.6.1, focusing on when response_uri may be omitted with the redirect_uri client identifier prefix and direct_post response mode. Confirm the intended normative behavior with the existing wording and update the affected specification text so the requirements no longer contradict each other.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100