openid / openid/OpenID4VP

Contradicting use of response_uri parameter

Open Beginner friendly
#666 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

Section 8.2 states that response_uri is REQUIRED when the Response Mode direct_post is used.

Section 5.9.3 contradicts this:
"redirect_uri: This prefix value indicates that the original Client Identifier part (without the prefix redirect_uri:) is the Verifier's Redirect URI (or Response URI when Response Mode direct_post is used). The Verifier MAY omit the redirect_uri Authorization Request parameter (or response_uri when Response Mode direct_post is used).

Suggest adjusting section 8.2 to reflect this exception.
Something along the lines of "REQUIRED when the Response Mode direct_post is used, unless combined with Client Identifier Prefix redirect_uri"

Alternatively given that B.2.6.1 states "The fourth element MUST be either the redirect_uri or response_uri request parameter, depending on which is present, as determined by the Response Mode."
and
"Unless otherwise stated, the values of client_id, nonce, redirect_uri, and response_uri request parameters referenced above MUST be obtained from the Authorization Request query parameters if the request is unsigned, or from the signed Request Object if the request is signed.",
removing the "MAY omit" sentence in section 5.9.3 might be a more appropriate remedy.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare Sections 8.2, 5.9.3, and B.2.6.1, focusing on when response_uri may be omitted with the redirect_uri client identifier prefix and direct_post response mode. Confirm the intended normative behavior with the existing wording and update the affected specification text so the requirements no longer contradict each other.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.