Question about encrypted responses
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-8.3-7 shows an example of an ecrypted response, which is a JSON object. I am a little confused as to when this response format should be used.
The direct_post response_mode defines that the HTTP POST request to the Verifier must be encoded in the request body using the format defined by the application/x-www-form-urlencoded HTTP content type. In this case I would expect the wallet to send the JWE in the response parameter, but not as a JSON object, but as a x-www-form-urlencoded parameter as it is defined in https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-8.3.1-4 for direct_post.jwt responses.
In which scenarios should the JSON Object format be used?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read sections 8.3-7 and 8.3.1-4 of the linked OpenID4VP specification, focusing on the encrypted response JSON object, direct_post, direct_post.jwt, and the response parameter. Compare the formats and document which scenarios use the JSON object format, with a clear distinction from form-encoded HTTP requests.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100