chore: c_nonce is recommended and AS takes care #323
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
peppelinux
requested review from
tlodderstedt,
Sakurann,
jogu,
c2bo,
paulbastian,
awoie and
bc-pi
bc-pi
requested changes
May 20, 2024
|
How about adding this recommendation for the |
peppelinux
commented
May 22, 2024
pmhsfelix
reviewed
May 23, 2024
paulbastian
requested changes
May 23, 2024
|
if the point of this PR is to recommend the usage of c_nonce in general (regardless of how the issuer provides c_nocne), the specification right now actually intends to mandate c_nonce (either from the token endpoint or credential endpoint).... i am inclined to close this issue until there is more clarity on the issues including #331 |
|
with the discussion in #331, the direction is to remove an option to return c_nonce from the token endpoint |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR aims to resolve the issue #313 where @andprian expressed her sensibility about some details that amtters about the security and the behaviour that an implementer may expect from the AS.
This PR does not address the revocation of a credential when a request for the same credential type occurs. As noted in the related issue, this behavior may be influenced by various factors outside the scope of this specification, including legal requirements already mentioned.