WebIDs MUST use a secure protocol
Nobody has claimed this yet.
- Dominant language
- Bikeshed
- Stars
- 26
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
All resources used in the context of Solid Authentication and Authorization MUST use a secure protocol.
Namely, a WebID used for Authentication MUST use the https protocol. That is true of both client and user WebIDs.
Currently, the specification states: "a WebID is a HTTP URI". I couldn't find any specific requirements about security in transit.
I appreciate that it seems a bit like stating the obvious, but I reckon it is fundamentally important enough to require an extension of section 3, probably with a 3.2 Encryption of WebIDs in transit.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read section 3 of the Solid OIDC specification and the current wording that describes WebIDs as HTTP URIs. Confirm how the specification distinguishes client and user WebIDs, then update the relevant requirement so authenticated WebIDs require HTTPS and verify the surrounding specification text remains consistent.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100