openid / openid/OpenID4VP

"Wallet MAY continue with JAR" is contradicted later in the spec and intended to be a MUST

Open
#779 2 comments 0 reactions 1 assignee View on GitHub

@c2bo is already working on this.

Since Aug 20, 2026.

certfication
Dominant language
Shell
Stars
112
Forks
38
Avg merge
12d 19h
Merged PRs (30d)
4

Description

https://openid.github.io/OpenID4VP/openid-4-verifiable-presentations-1_1-wg-draft.html#name-authorization-request says:

The Wallet MAY continue with JAR when it receives request_uri_method parameter with the value post but does not support this feature.

I don't think this is correct; this is actually a MUST I believe - https://openid.github.io/OpenID4VP/openid-4-verifiable-presentations-1_1-wg-draft.html#name-new-parameters says:

Wallets not supporting the post method will send a GET request to the Request URI (default behavior as defined in [RFC9101]).

I'd be tempted to put that 'will' as a MUST too, but I think it's probably clear as is. Deleting 'will' would work too.

I suggest changing the 'MAY continue with JAR' to a 'MUST' (or possibly removing the 'MAY' from the sentence, or just removing the sentence entirely.)

The certification tests treat the 'MAY' as a 'MUST'.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.